ae84cf6dccbf8c51d0c0c05bde02e1ff424928a691f7b5c5d46e43a9c89cdb11

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 13:20

Target

c5f915f27d50eda521182edd51e48272.dll
Size

30KB
MD5

c5f915f27d50eda521182edd51e48272
SHA1

6ad199cdd9333852fdc32635c827edbf25fc5c4b
SHA256

ae84cf6dccbf8c51d0c0c05bde02e1ff424928a691f7b5c5d46e43a9c89cdb11
SHA512

4564ed56734aa46ec280e9dce2210deb855933c6771ca2fe669f0525dcfb71b20bb1b94009ab36d3543c910969c05b7a4164e348f6aefa306d95a15737076972
SSDEEP

384:wWpUKxpNOHIfctUig8gqIjpychfmNydyBgqRNdwcf5O:rh4of2UiJUTJmNydyB59wU5O

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2396	2228	rundll32.exe	28
PID 2228 wrote to memory of 2396	2228	rundll32.exe	28
PID 2228 wrote to memory of 2396	2228	rundll32.exe	28
PID 2228 wrote to memory of 2396	2228	rundll32.exe	28
PID 2228 wrote to memory of 2396	2228	rundll32.exe	28
PID 2228 wrote to memory of 2396	2228	rundll32.exe	28
PID 2228 wrote to memory of 2396	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5f915f27d50eda521182edd51e48272.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5f915f27d50eda521182edd51e48272.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2396

memory/2396-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download