e9e3666b70d35e6c15e21d7ac0942746757b3e31a198a5801f60f35f3fd799b0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 21:57

Target

e9e3666b70d35e6c15e21d7ac0942746757b3e31a198a5801f60f35f3fd799b0.dll
Size

397KB
MD5

72f38d6b5d27cd1fbf91e66d82c42cbb
SHA1

2a17fcfe8c4fb6af26d25b1b6867a0e83744da3e
SHA256

e9e3666b70d35e6c15e21d7ac0942746757b3e31a198a5801f60f35f3fd799b0
SHA512

87ddadf1db36fb40d759dc820436dbb60bcaa4169e154286b49d77057be1863b1232454c7a6e9e266de66b1d95eacca6a38d7ca0aa6ad1ac65054e81680a6c7e
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOat:174g2LDeiPDImOkx2LIat

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2912	rundll32.exe
2912	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	rundll32.exe
Token: SeTcbPrivilege	2912	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2912	2860	rundll32.exe	8
PID 2860 wrote to memory of 2912	2860	rundll32.exe	8
PID 2860 wrote to memory of 2912	2860	rundll32.exe	8
PID 2860 wrote to memory of 2912	2860	rundll32.exe	8
PID 2860 wrote to memory of 2912	2860	rundll32.exe	8
PID 2860 wrote to memory of 2912	2860	rundll32.exe	8
PID 2860 wrote to memory of 2912	2860	rundll32.exe	8

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9e3666b70d35e6c15e21d7ac0942746757b3e31a198a5801f60f35f3fd799b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9e3666b70d35e6c15e21d7ac0942746757b3e31a198a5801f60f35f3fd799b0.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912