c38f1fcf1a2d5b1cea2d24d47afdc38ca6b27e12436b94d038e0859fa07fd2b0

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 05:11 UTC

Target

$PLUGINSDIR/AddJoyDrivers.dll
Size

57KB
MD5

dcaaa4e03b699a15e82c5d7f5a08198c
SHA1

53ac54901fb73e61be58609444a6ddefd462ca52
SHA256

1507b8b3fbb410a71c2e0b9c410e2518b055a77f39fe4dbe28facba07da3050a
SHA512

9cdd91c54db0c498160672a2a7be142956dfa2350ffb8dcfe45d76637a591967d55ac187e8dd5332f2862592204f3fbb8465bd942f2b5a87ee091b35a730d8d1
SSDEEP

768:Gm4iBKo1ppdxn6o5QtqOG8MuNIAD6H0DCAg4MTJ0+KHIA+o:MiBKoXx6axkIpH0IG+WIA+

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	HELPER64.EXE

Suspicious use of AdjustPrivilegeToken 7 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1736	2320	rundll32.exe	28
PID 2320 wrote to memory of 1736	2320	rundll32.exe	28
PID 2320 wrote to memory of 1736	2320	rundll32.exe	28
PID 2320 wrote to memory of 1736	2320	rundll32.exe	28
PID 2320 wrote to memory of 1736	2320	rundll32.exe	28
PID 2320 wrote to memory of 1736	2320	rundll32.exe	28
PID 2320 wrote to memory of 1736	2320	rundll32.exe	28
PID 1736 wrote to memory of 2088	1736	rundll32.exe	29
PID 1736 wrote to memory of 2088	1736	rundll32.exe	29
PID 1736 wrote to memory of 2088	1736	rundll32.exe	29
PID 1736 wrote to memory of 2088	1736	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AddJoyDrivers.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AddJoyDrivers.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\HELPER64.EXE
    "MZ\"
    3⤵
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2088