68b729d1c7e6b424b230931dc74db2c90c08d4923130582c80a295e144dba43f

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 16:35

Target

$COMMONFILES/nProtect Shared/Engine/tyav32u.dll
Size

981KB
MD5

16a4711cae83a30cd2a93d3af0188ef9
SHA1

a385856f1c49a3f3f2b6ecdca65377b0cece0d81
SHA256

e536c6d79e7e80d9b5e0a7a1a06edb97f79010a741f324ea82e472e99e56e4de
SHA512

22310c8371c338b364e33c2e6f69618ad6a26ab6a5c449c3567f6c4e32650fdb04cae087956bfa4758457f0d358e3f58939cc679917acd27d32cbf4070eb91cf
SSDEEP

24576:2vb+yowbljDmoEoaY+UR9XUmMjJJfUHThoRujiW:ejz1iJMHTqNW

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3064	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\nProtect Shared\Engine\tyav32u.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\nProtect Shared\Engine\tyav32u.dll",#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3064