d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 10:23

Target

d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f.dll
Size

397KB
MD5

e7fba96ab6522a0cbcc89b3340dc0146
SHA1

4ee9816f580572897e4abe2050d86807004c3017
SHA256

d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f
SHA512

6bb8b6c5affa6a0409f636fa8611e25e562a2a0f654d2dad0dd8f95e6469a72f441d1ceb7a0198c6bf65280b4fdb555a6d0fc8678efc650ebf1c609c7dcfb0ac
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOal:174g2LDeiPDImOkx2LIal

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1976	rundll32.exe
1976	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	rundll32.exe
Token: SeTcbPrivilege	1976	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1976	1688	rundll32.exe	28
PID 1688 wrote to memory of 1976	1688	rundll32.exe	28
PID 1688 wrote to memory of 1976	1688	rundll32.exe	28
PID 1688 wrote to memory of 1976	1688	rundll32.exe	28
PID 1688 wrote to memory of 1976	1688	rundll32.exe	28
PID 1688 wrote to memory of 1976	1688	rundll32.exe	28
PID 1688 wrote to memory of 1976	1688	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1976