c430b8a9af18c2389e4ccce85fa834b46f464a81033325dffa8543f356f398ef

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 01:37

Target

b6300eddbe409d99eead94f4e118e095.dll
Size

33KB
MD5

b6300eddbe409d99eead94f4e118e095
SHA1

987af929eb4397c04fa224f2c309098b5ab6249c
SHA256

c430b8a9af18c2389e4ccce85fa834b46f464a81033325dffa8543f356f398ef
SHA512

470b7580717d2288aec94849b73deb079c733bd115aade8cc5c149f79f1ec2a469ac326220c3af90ca5fc07c8b4b84d37d8d5987b2fe3c5596a1f0257a50d253
SSDEEP

384:LAl+O6+qTVqVTuZg4V2a8aOSP8wX/hqLpm+gGZYjB:Et6nuTSg4V2a8aOSPtQm+RZK

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\gmjgty.dll	rundll32.exe
File created	C:\Windows\SysWOW64\gmjgty.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	rundll32.exe
Token: SeDebugPrivilege	2808	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2808	2768	rundll32.exe	28
PID 2768 wrote to memory of 2808	2768	rundll32.exe	28
PID 2768 wrote to memory of 2808	2768	rundll32.exe	28
PID 2768 wrote to memory of 2808	2768	rundll32.exe	28
PID 2768 wrote to memory of 2808	2768	rundll32.exe	28
PID 2768 wrote to memory of 2808	2768	rundll32.exe	28
PID 2768 wrote to memory of 2808	2768	rundll32.exe	28
PID 2808 wrote to memory of 1208	2808	rundll32.exe	21
PID 2808 wrote to memory of 1208	2808	rundll32.exe	21

memory/1208-2-0x0000000001C70000-0x0000000001C71000-memory.dmp

Filesize
4KB

Download