217c4221c43cc3befc59347e562f8677a34df5f376e294fce9eadb316e12de20

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 03:07

Target

217c4221c43cc3befc59347e562f8677a34df5f376e294fce9eadb316e12de20.dll
Size

397KB
MD5

5cb05759ed784438702b641ee5791971
SHA1

fdc029ed87578680f4209f42205520f9a09b750c
SHA256

217c4221c43cc3befc59347e562f8677a34df5f376e294fce9eadb316e12de20
SHA512

50fd08a35ff9de55d3b9b566d03b362349e4cbde464be9143f2758700ba96ecd690fdabf47d329798c7fa483bdef03107707eea4dc08ff51e1f9f8365b9fa2b9
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa0:174g2LDeiPDImOkx2LIa0

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	rundll32.exe
Token: SeTcbPrivilege	2892	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2892	2872	rundll32.exe	28
PID 2872 wrote to memory of 2892	2872	rundll32.exe	28
PID 2872 wrote to memory of 2892	2872	rundll32.exe	28
PID 2872 wrote to memory of 2892	2872	rundll32.exe	28
PID 2872 wrote to memory of 2892	2872	rundll32.exe	28
PID 2872 wrote to memory of 2892	2872	rundll32.exe	28
PID 2872 wrote to memory of 2892	2872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\217c4221c43cc3befc59347e562f8677a34df5f376e294fce9eadb316e12de20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\217c4221c43cc3befc59347e562f8677a34df5f376e294fce9eadb316e12de20.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892