33f5b8d3bbf6f5b70a1d85452298765ddf028ac723b7ea2eaaa37467f09b4c4f

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 13:43 UTC

Target

c3839c9e4fcf9b36fb2ef2aa32f474f9.dll
Size

33KB
MD5

c3839c9e4fcf9b36fb2ef2aa32f474f9
SHA1

8c673fab53bb2694ea06e49f0f407c14e9a83531
SHA256

33f5b8d3bbf6f5b70a1d85452298765ddf028ac723b7ea2eaaa37467f09b4c4f
SHA512

1fc0f413507143e25f323dea9c2543d44652bf6dc9574085be4f6b0c6bbca391717422bdee85e3a4b1bf8dd97fe4e607e994bdd8749adde4b14728ed3afc901f
SSDEEP

768:t+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:t+av6qZ4QxpP0AtNfRJ5BHxY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2924	1308	rundll32.exe	28
PID 1308 wrote to memory of 2924	1308	rundll32.exe	28
PID 1308 wrote to memory of 2924	1308	rundll32.exe	28
PID 1308 wrote to memory of 2924	1308	rundll32.exe	28
PID 1308 wrote to memory of 2924	1308	rundll32.exe	28
PID 1308 wrote to memory of 2924	1308	rundll32.exe	28
PID 1308 wrote to memory of 2924	1308	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3839c9e4fcf9b36fb2ef2aa32f474f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3839c9e4fcf9b36fb2ef2aa32f474f9.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2924

memory/2924-0-0x0000000074710000-0x000000007479D000-memory.dmp

Filesize
564KB

Download
memory/2924-1-0x0000000075D00000-0x0000000075DF0000-memory.dmp

Filesize
960KB

Download