60809b392b7980d5e2174636544ec576f9ebedd44741a9a5bb7bf8e3679c9b3e

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 22:38

Target

60809b392b7980d5e2174636544ec576f9ebedd44741a9a5bb7bf8e3679c9b3e.dll
Size

397KB
MD5

4cae51e3a49568205822a51781f4f524
SHA1

af8c6229165abb32f23529e394c653b25f758d74
SHA256

60809b392b7980d5e2174636544ec576f9ebedd44741a9a5bb7bf8e3679c9b3e
SHA512

951431817b359d8fc3ed4e823abf8162f591bf7fc71591f6d572c0a9d79991bfe04e94e992edb6686bc5b2c7b8b15272c42e2786a4c2f252a1827b44dc1485ce
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOag:174g2LDeiPDImOkx2LIag

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1772	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	rundll32.exe
Token: SeTcbPrivilege	1772	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1772	1152	rundll32.exe	28
PID 1152 wrote to memory of 1772	1152	rundll32.exe	28
PID 1152 wrote to memory of 1772	1152	rundll32.exe	28
PID 1152 wrote to memory of 1772	1152	rundll32.exe	28
PID 1152 wrote to memory of 1772	1152	rundll32.exe	28
PID 1152 wrote to memory of 1772	1152	rundll32.exe	28
PID 1152 wrote to memory of 1772	1152	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60809b392b7980d5e2174636544ec576f9ebedd44741a9a5bb7bf8e3679c9b3e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60809b392b7980d5e2174636544ec576f9ebedd44741a9a5bb7bf8e3679c9b3e.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1772