ae43ad60d0eb7a6b8f95b6c908479f53fbd55e6238b2ce6e697deffda0db9b91

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 19:53

Target

ae43ad60d0eb7a6b8f95b6c908479f53fbd55e6238b2ce6e697deffda0db9b91.dll
Size

397KB
MD5

7805cf53e4f223ae8817589ae14be0b0
SHA1

a503ef85bea54b6c982549a84ecf632e9c91b056
SHA256

ae43ad60d0eb7a6b8f95b6c908479f53fbd55e6238b2ce6e697deffda0db9b91
SHA512

32034ae565a0954a095cc7a7a1c4660fee5755fa22491497bb8c76c31ac446538e5f71a0bdf211a8d73453c958a4d367534ebc78c348543d78b7dbd2464e99d5
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaE:174g2LDeiPDImOkx2LIaE

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2056	rundll32.exe
2056	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	rundll32.exe
Token: SeTcbPrivilege	2056	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2056	2212	rundll32.exe	28
PID 2212 wrote to memory of 2056	2212	rundll32.exe	28
PID 2212 wrote to memory of 2056	2212	rundll32.exe	28
PID 2212 wrote to memory of 2056	2212	rundll32.exe	28
PID 2212 wrote to memory of 2056	2212	rundll32.exe	28
PID 2212 wrote to memory of 2056	2212	rundll32.exe	28
PID 2212 wrote to memory of 2056	2212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae43ad60d0eb7a6b8f95b6c908479f53fbd55e6238b2ce6e697deffda0db9b91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae43ad60d0eb7a6b8f95b6c908479f53fbd55e6238b2ce6e697deffda0db9b91.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2056