7f0e77a6ea2e4985006b15e017655ed76af461c71becf04147583da2292d5750

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 11:22

Target

7f0e77a6ea2e4985006b15e017655ed76af461c71becf04147583da2292d5750.dll
Size

397KB
MD5

28f7825ec7073265f3b59ebcac19a036
SHA1

745fb2b82ebaaa83ad4f472e2ed92272d85b14cb
SHA256

7f0e77a6ea2e4985006b15e017655ed76af461c71becf04147583da2292d5750
SHA512

5e9fa3cd973956d2a492d0fb9bb0642d58e809037331c600eba0b2d1ef9a33995ae34613962075b8f2afb3360856bdaf7bf32269b7fb59661cb4db26be49a28d
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaZ:174g2LDeiPDImOkx2LIaZ

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	rundll32.exe
Token: SeTcbPrivilege	2864	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2864	1740	rundll32.exe	28
PID 1740 wrote to memory of 2864	1740	rundll32.exe	28
PID 1740 wrote to memory of 2864	1740	rundll32.exe	28
PID 1740 wrote to memory of 2864	1740	rundll32.exe	28
PID 1740 wrote to memory of 2864	1740	rundll32.exe	28
PID 1740 wrote to memory of 2864	1740	rundll32.exe	28
PID 1740 wrote to memory of 2864	1740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f0e77a6ea2e4985006b15e017655ed76af461c71becf04147583da2292d5750.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f0e77a6ea2e4985006b15e017655ed76af461c71becf04147583da2292d5750.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864