09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
23-03-2024 17:28

Target

09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0.dll
Size

185KB
MD5

e15fc1136589422437e1cbb4c58abf13
SHA1

3f9ac7f863297eb300c5cc9224bfbfb9071ae13d
SHA256

09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0
SHA512

e66615c9af558fe27cfadf27af23a09b3c1b31866e98c442dc48a6f4fed72400da3731b6353d477d64e587d63129c95de37d23d0dbdcdb4b4866f57805e6578a
SSDEEP

3072:Pui8BeS3MmdOwH6Yq8xWd84HQ5ijAELS9JkCXrq2dMKCurrXnYc6:Pui8Bp1Owrq8084HJAELyWCrLYx

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	rundll32.exe
Token: SeTcbPrivilege	1960	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 1960	340	rundll32.exe	28
PID 340 wrote to memory of 1960	340	rundll32.exe	28
PID 340 wrote to memory of 1960	340	rundll32.exe	28
PID 340 wrote to memory of 1960	340	rundll32.exe	28
PID 340 wrote to memory of 1960	340	rundll32.exe	28
PID 340 wrote to memory of 1960	340	rundll32.exe	28
PID 340 wrote to memory of 1960	340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1960