72adb10563539d18a93f613eb15c6e3df6e76e5392a0f138222b6b823c99b6fd

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 00:46

Target

b615a5f49509c35f9b17379b819cfc3c.dll
Size

11KB
MD5

b615a5f49509c35f9b17379b819cfc3c
SHA1

c13de9f64c924d2a5d224005ac0a67a2ca9db72a
SHA256

72adb10563539d18a93f613eb15c6e3df6e76e5392a0f138222b6b823c99b6fd
SHA512

9f37c02497982b2b9046f20c62dee9a31f88b49bc7a1d7ad32c33136e8873360941f51886ef72e9d03a04bdaab900dcecbebf8b74d2a40a99e789495243524dd
SSDEEP

192:AyJi6LQ2Hjwcg2T/2a0F3O15EJNe13I2HD5VL6UvIdLp1XX0iuGjTkgUw9S:A+vLQ7chTOa0F3O15EG13I2HULp1XX9k

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b615a5f49509c35f9b17379b819cfc3c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b615a5f49509c35f9b17379b819cfc3c.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2932

memory/2932-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2932-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download