53999599cf01bfc9cc10bfb90219d7ec83c7ba03f6c6e922b08684627f185edf

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 10:49

Target

bb12ad7c2423a31b3053396807a89474.dll
Size

13KB
MD5

bb12ad7c2423a31b3053396807a89474
SHA1

5632c81c8b32d5bcdf1cafdc63d14a84d76b8d4b
SHA256

53999599cf01bfc9cc10bfb90219d7ec83c7ba03f6c6e922b08684627f185edf
SHA512

421a7186864c79990cce0d8965c77f466dddb822ef0c1553ecd33195e4a6ab9719ba9ba7d3d02260a3fb4166384bda9474ce1fae677d7dafeb73018f90c8f1b7
SSDEEP

192:uJhrAbTBLgxTFexspPn6AEOhHl/UdTHfQ1E5NMuiMsZSqN1Q7DBQloPXjQ6xkgUC:uPuBLgxYKpyjYHl/G74m7jsgt7D4yR

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2896	1420	rundll32.exe	28
PID 1420 wrote to memory of 2896	1420	rundll32.exe	28
PID 1420 wrote to memory of 2896	1420	rundll32.exe	28
PID 1420 wrote to memory of 2896	1420	rundll32.exe	28
PID 1420 wrote to memory of 2896	1420	rundll32.exe	28
PID 1420 wrote to memory of 2896	1420	rundll32.exe	28
PID 1420 wrote to memory of 2896	1420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb12ad7c2423a31b3053396807a89474.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb12ad7c2423a31b3053396807a89474.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2896

memory/2896-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download