7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 15:07

Target

7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878.dll
Size

397KB
MD5

cb5fe606c0684da3911d73a96b95925b
SHA1

cb495ac76819503008c93c6536f0819ccf10a30c
SHA256

7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878
SHA512

0f7c2d60c429676dcf6db7ddcb7ed17ade0aa229494118de921d67f6b772bcfe3390b66af80abf7ea476a603093ce74d8e1ae72dbc093d002d6e8de4d7873219
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaN:174g2LDeiPDImOkx2LIaN

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	rundll32.exe
Token: SeTcbPrivilege	2204	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2204	2180	rundll32.exe	28
PID 2180 wrote to memory of 2204	2180	rundll32.exe	28
PID 2180 wrote to memory of 2204	2180	rundll32.exe	28
PID 2180 wrote to memory of 2204	2180	rundll32.exe	28
PID 2180 wrote to memory of 2204	2180	rundll32.exe	28
PID 2180 wrote to memory of 2204	2180	rundll32.exe	28
PID 2180 wrote to memory of 2204	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2204