013f49b1709a70e58968ff552cfdce0fa9903dfd276e5b092a23a05a782f5db3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 18:17

Target

MCFUNC.dll
Size

216KB
MD5

936cca0155f0ace1a85fd8eb9f5d3b32
SHA1

dccf9eb963138e9441c21ec4b3a0ab98c1e01b2c
SHA256

21d3cddb541ddb29ca853e3539e3d30f69cd485c8bdfc273413fd3fb1d221a75
SHA512

0a0d5185c2631ecdcec2815192b33b1931f0d7f6da921e91b996c761cefeafe4065c2d1a988efe0d48c2f25de3a9768b40347b08afbfb57f8645be4635377d36
SSDEEP

3072:f0RV1B1oZaeiJQREAO0yuXm06KgaiUahX+ZR4vMYkPFX8zINglUNqel8VQ:ML3oseiQO0yVQq498INtNq3

Score

1^/10

Suspicious behavior: EnumeratesProcesses 48 IoCs

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2156	rundll32.exe
Token: SeSecurityPrivilege	2156	rundll32.exe
Token: SeTakeOwnershipPrivilege	2156	rundll32.exe
Token: SeLoadDriverPrivilege	2156	rundll32.exe
Token: SeSystemProfilePrivilege	2156	rundll32.exe
Token: SeSystemtimePrivilege	2156	rundll32.exe
Token: SeProfSingleProcessPrivilege	2156	rundll32.exe
Token: SeIncBasePriorityPrivilege	2156	rundll32.exe
Token: SeCreatePagefilePrivilege	2156	rundll32.exe
Token: SeShutdownPrivilege	2156	rundll32.exe
Token: SeDebugPrivilege	2156	rundll32.exe
Token: SeSystemEnvironmentPrivilege	2156	rundll32.exe
Token: SeRemoteShutdownPrivilege	2156	rundll32.exe
Token: SeUndockPrivilege	2156	rundll32.exe
Token: SeManageVolumePrivilege	2156	rundll32.exe
Token: 33	2156	rundll32.exe
Token: 34	2156	rundll32.exe
Token: 35	2156	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 356 wrote to memory of 2156	356	rundll32.exe	28
PID 356 wrote to memory of 2156	356	rundll32.exe	28
PID 356 wrote to memory of 2156	356	rundll32.exe	28
PID 356 wrote to memory of 2156	356	rundll32.exe	28
PID 356 wrote to memory of 2156	356	rundll32.exe	28
PID 356 wrote to memory of 2156	356	rundll32.exe	28
PID 356 wrote to memory of 2156	356	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MCFUNC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MCFUNC.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2156

memory/2156-0-0x0000000075760000-0x0000000075870000-memory.dmp

Filesize
1.1MB

Download
memory/2156-1-0x0000000075760000-0x0000000075870000-memory.dmp

Filesize
1.1MB

Download
memory/2156-3-0x000000005F070000-0x000000005F071000-memory.dmp

Filesize
4KB

Download
memory/2156-2-0x000000005F080000-0x000000005F081000-memory.dmp

Filesize
4KB

Download
memory/2156-4-0x0000000075760000-0x0000000075870000-memory.dmp

Filesize
1.1MB

Download