e678af69ffb103bcf372d6190f4987fc5ca7fd4ab89e992c2c3d98aec6b7073c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 15:33

Target

e678af69ffb103bcf372d6190f4987fc5ca7fd4ab89e992c2c3d98aec6b7073c.dll
Size

397KB
MD5

e1072e0d91f84964ca6ed817f9aecba2
SHA1

dd778e5924939aad7dd5b94832071883b1d2501c
SHA256

e678af69ffb103bcf372d6190f4987fc5ca7fd4ab89e992c2c3d98aec6b7073c
SHA512

973019a686276ce8e3ff3f8422b2e113661a5123eb6394def2458872d95b789d025f152b5c9a800a4febe38fb79a9e5ae286022f48855f0234e46cd6d2028da6
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOao:174g2LDeiPDImOkx2LIao

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
756	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	rundll32.exe
Token: SeTcbPrivilege	756	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 756	2760	rundll32.exe	28
PID 2760 wrote to memory of 756	2760	rundll32.exe	28
PID 2760 wrote to memory of 756	2760	rundll32.exe	28
PID 2760 wrote to memory of 756	2760	rundll32.exe	28
PID 2760 wrote to memory of 756	2760	rundll32.exe	28
PID 2760 wrote to memory of 756	2760	rundll32.exe	28
PID 2760 wrote to memory of 756	2760	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e678af69ffb103bcf372d6190f4987fc5ca7fd4ab89e992c2c3d98aec6b7073c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e678af69ffb103bcf372d6190f4987fc5ca7fd4ab89e992c2c3d98aec6b7073c.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:756