a8bac777f28d694211091630d80a7b93d85bcccb3365d283557392614a73eb85

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 18:20

Target

65b5e5b8d29b49714b7fa4976f7d4cb1.dll
Size

384KB
MD5

65b5e5b8d29b49714b7fa4976f7d4cb1
SHA1

dffed2e688b8595b6ec4bd02966602c5f12019da
SHA256

a8bac777f28d694211091630d80a7b93d85bcccb3365d283557392614a73eb85
SHA512

32a35387173e24d179250163a081518239248ae6c7b692827d3a177c2d330ad662c3b3afaa581679112b308205dcf4bd2c2b0962ea061ebbc9a1dcbbf6da5536
SSDEEP

6144:3QGEMZav4sDi5iJuT/s9vki85GRi+/G7dmCS29m1aEoi8zf9tMXVC33Rw:RHZlsDdbVznalNmJnEcwnRw

Score

1^/10

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2052	rundll32.exe
Token: SeSecurityPrivilege	2052	rundll32.exe
Token: SeTakeOwnershipPrivilege	2052	rundll32.exe
Token: SeLoadDriverPrivilege	2052	rundll32.exe
Token: SeSystemProfilePrivilege	2052	rundll32.exe
Token: SeSystemtimePrivilege	2052	rundll32.exe
Token: SeProfSingleProcessPrivilege	2052	rundll32.exe
Token: SeIncBasePriorityPrivilege	2052	rundll32.exe
Token: SeCreatePagefilePrivilege	2052	rundll32.exe
Token: SeShutdownPrivilege	2052	rundll32.exe
Token: SeDebugPrivilege	2052	rundll32.exe
Token: SeSystemEnvironmentPrivilege	2052	rundll32.exe
Token: SeRemoteShutdownPrivilege	2052	rundll32.exe
Token: SeUndockPrivilege	2052	rundll32.exe
Token: SeManageVolumePrivilege	2052	rundll32.exe
Token: 33	2052	rundll32.exe
Token: 34	2052	rundll32.exe
Token: 35	2052	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2052	2240	rundll32.exe	28
PID 2240 wrote to memory of 2052	2240	rundll32.exe	28
PID 2240 wrote to memory of 2052	2240	rundll32.exe	28
PID 2240 wrote to memory of 2052	2240	rundll32.exe	28
PID 2240 wrote to memory of 2052	2240	rundll32.exe	28
PID 2240 wrote to memory of 2052	2240	rundll32.exe	28
PID 2240 wrote to memory of 2052	2240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65b5e5b8d29b49714b7fa4976f7d4cb1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65b5e5b8d29b49714b7fa4976f7d4cb1.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2052

memory/2052-0-0x0000000001BF0000-0x0000000001CD5000-memory.dmp

Filesize
916KB

Download
memory/2052-1-0x0000000001BF0000-0x0000000001CD5000-memory.dmp

Filesize
916KB

Download
memory/2052-2-0x0000000001BF0000-0x0000000001CD5000-memory.dmp

Filesize
916KB

Download
memory/2052-3-0x0000000077850000-0x0000000077960000-memory.dmp

Filesize
1.1MB

Download
memory/2052-4-0x000000005F080000-0x000000005F081000-memory.dmp

Filesize
4KB

Download
memory/2052-5-0x000000005F070000-0x000000005F071000-memory.dmp

Filesize
4KB

Download
memory/2052-6-0x0000000077850000-0x0000000077960000-memory.dmp

Filesize
1.1MB

Download