e7f337d08bfe3c7b01775c5927f2f4a974e1c3ec56ff20040a70fbfc0becbf9d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 15:19

Target

e7f337d08bfe3c7b01775c5927f2f4a974e1c3ec56ff20040a70fbfc0becbf9d.dll
Size

397KB
MD5

9672b59762ab2fbb3505fbfdfab5f201
SHA1

3158ce7df371384dea6f3817e5f46282db2ccaed
SHA256

e7f337d08bfe3c7b01775c5927f2f4a974e1c3ec56ff20040a70fbfc0becbf9d
SHA512

dedf2268b42bd815efca75972beb70292548f7aac27f88af52c1b7a7467c33c56e7fe1b1a52c8a0ce30984c78c97607650e9dbc965ba654fa056f2a7ae5ecef1
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaB:174g2LDeiPDImOkx2LIaB

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1508	rundll32.exe
Token: SeTcbPrivilege	1508	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1508	2176	rundll32.exe	28
PID 2176 wrote to memory of 1508	2176	rundll32.exe	28
PID 2176 wrote to memory of 1508	2176	rundll32.exe	28
PID 2176 wrote to memory of 1508	2176	rundll32.exe	28
PID 2176 wrote to memory of 1508	2176	rundll32.exe	28
PID 2176 wrote to memory of 1508	2176	rundll32.exe	28
PID 2176 wrote to memory of 1508	2176	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7f337d08bfe3c7b01775c5927f2f4a974e1c3ec56ff20040a70fbfc0becbf9d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7f337d08bfe3c7b01775c5927f2f4a974e1c3ec56ff20040a70fbfc0becbf9d.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1508