9a1c16b8e2e5665477e5176c1c72eef5fbeba5a05d8b92c675145c72030cd4ad

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 20:40

Target

9a1c16b8e2e5665477e5176c1c72eef5fbeba5a05d8b92c675145c72030cd4ad.dll
Size

397KB
MD5

5ead7a2ca6fa391c1464ba70775a2ca1
SHA1

95eb9dbbb24254198735b768861378040ebad559
SHA256

9a1c16b8e2e5665477e5176c1c72eef5fbeba5a05d8b92c675145c72030cd4ad
SHA512

e9de38f02f251c5a8f2ed7af50437b7d33041b0c25b23d5bbd8ff49d6021482358bd4dc216c4774aebeb70debee1c170a54c81797b3bc7a7ea4c17315d6ee7b9
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa4:174g2LDeiPDImOkx2LIa4

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	rundll32.exe
Token: SeTcbPrivilege	2456	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2456	2296	rundll32.exe	28
PID 2296 wrote to memory of 2456	2296	rundll32.exe	28
PID 2296 wrote to memory of 2456	2296	rundll32.exe	28
PID 2296 wrote to memory of 2456	2296	rundll32.exe	28
PID 2296 wrote to memory of 2456	2296	rundll32.exe	28
PID 2296 wrote to memory of 2456	2296	rundll32.exe	28
PID 2296 wrote to memory of 2456	2296	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a1c16b8e2e5665477e5176c1c72eef5fbeba5a05d8b92c675145c72030cd4ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a1c16b8e2e5665477e5176c1c72eef5fbeba5a05d8b92c675145c72030cd4ad.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456