a829e33c5e4db2ea90f23d2eadca782d318d53f2fcd6cb2d4d804af9255d76ba

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 13:12

Target

a829e33c5e4db2ea90f23d2eadca782d318d53f2fcd6cb2d4d804af9255d76ba.dll
Size

397KB
MD5

a5ea13f45f50990ba4d8e88cea233d96
SHA1

1244482747721a88e764cffd320df8fac0425a65
SHA256

a829e33c5e4db2ea90f23d2eadca782d318d53f2fcd6cb2d4d804af9255d76ba
SHA512

07cf0ee4eed0833672c48f14fd6888928787b00b6d2648a363e679557e828a942c3db54f553069192d601caf717d2ef05e860342d57de5d6f339cec546a7496e
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOav:174g2LDeiPDImOkx2LIav

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	rundll32.exe
Token: SeTcbPrivilege	2356	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2356	1668	rundll32.exe	28
PID 1668 wrote to memory of 2356	1668	rundll32.exe	28
PID 1668 wrote to memory of 2356	1668	rundll32.exe	28
PID 1668 wrote to memory of 2356	1668	rundll32.exe	28
PID 1668 wrote to memory of 2356	1668	rundll32.exe	28
PID 1668 wrote to memory of 2356	1668	rundll32.exe	28
PID 1668 wrote to memory of 2356	1668	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a829e33c5e4db2ea90f23d2eadca782d318d53f2fcd6cb2d4d804af9255d76ba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a829e33c5e4db2ea90f23d2eadca782d318d53f2fcd6cb2d4d804af9255d76ba.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2356