75cd665ec59e8d46bcc370ab5077fa7a7a5927256c0badd6c81a4a51d06f6579

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 18:45

Target

75cd665ec59e8d46bcc370ab5077fa7a7a5927256c0badd6c81a4a51d06f6579.dll
Size

397KB
MD5

26aa6fb2f691680533f27a2439294399
SHA1

473d2ea654a5bba014011dfcccaea44b0603c81d
SHA256

75cd665ec59e8d46bcc370ab5077fa7a7a5927256c0badd6c81a4a51d06f6579
SHA512

2f8fe3a2cfe2aec045d529e824386a9e3113107abb2f492fae5f1eabf71a07439649756a5059645ad4bf089e8d84c03103ca9182a156411f0206506d8f32836c
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa7:174g2LDeiPDImOkx2LIa7

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	rundll32.exe
Token: SeTcbPrivilege	2196	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2196	1632	rundll32.exe	28
PID 1632 wrote to memory of 2196	1632	rundll32.exe	28
PID 1632 wrote to memory of 2196	1632	rundll32.exe	28
PID 1632 wrote to memory of 2196	1632	rundll32.exe	28
PID 1632 wrote to memory of 2196	1632	rundll32.exe	28
PID 1632 wrote to memory of 2196	1632	rundll32.exe	28
PID 1632 wrote to memory of 2196	1632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75cd665ec59e8d46bcc370ab5077fa7a7a5927256c0badd6c81a4a51d06f6579.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\75cd665ec59e8d46bcc370ab5077fa7a7a5927256c0badd6c81a4a51d06f6579.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2196