40f70e065fdad378dfa959cf446dcad8e52df0d934821015892eae69715ff11b

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 08:56

Target

40f70e065fdad378dfa959cf446dcad8e52df0d934821015892eae69715ff11b.dll
Size

397KB
MD5

ec32b1f809da31fc4f4c0221f9c91ec5
SHA1

1ab627d6b057aad8dbf6227dee5162644f2379ce
SHA256

40f70e065fdad378dfa959cf446dcad8e52df0d934821015892eae69715ff11b
SHA512

fa04c41149fd78feb85882117425771d84977120ebaa7b9b0c629d3732d9872bfb5d147697019b7eba20d56cf104965864892c905970e8504f966f25f89f9132
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOav:174g2LDeiPDImOkx2LIav

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	rundll32.exe
Token: SeTcbPrivilege	1960	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1960	1468	rundll32.exe	28
PID 1468 wrote to memory of 1960	1468	rundll32.exe	28
PID 1468 wrote to memory of 1960	1468	rundll32.exe	28
PID 1468 wrote to memory of 1960	1468	rundll32.exe	28
PID 1468 wrote to memory of 1960	1468	rundll32.exe	28
PID 1468 wrote to memory of 1960	1468	rundll32.exe	28
PID 1468 wrote to memory of 1960	1468	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40f70e065fdad378dfa959cf446dcad8e52df0d934821015892eae69715ff11b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40f70e065fdad378dfa959cf446dcad8e52df0d934821015892eae69715ff11b.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960