70344ece62a828c46ff315b3328125d8ab5f6902bbeaa24224fee97142ee6ad9

Analysis

Target

70344ece62a828c46ff315b3328125d8ab5f6902bbeaa24224fee97142ee6ad9.bin.dll
Size

80KB
MD5

5b615cfd2ec6aa4f6242197481fc108b
SHA1

fc366c0f83711fed7303b752abf09f2be74e2a15
SHA256

70344ece62a828c46ff315b3328125d8ab5f6902bbeaa24224fee97142ee6ad9
SHA512

6080fa1e08239533e726cae2420b885627e53a7bbf9fd1fad1d2c861ebdf94262f8540f841a8dfa1956148d7601ec7a4a22ef965a0a7776bbb96e8535c6c30fe

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2612	rundll32.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\International	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2612	rundll32.exe
2612	rundll32.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeBackupPrivilege	2612	rundll32.exe
Token: SeDebugPrivilege	2612	rundll32.exe
Token: 36	2612	rundll32.exe
Token: SeImpersonatePrivilege	2612	rundll32.exe
Token: SeIncBasePriorityPrivilege	2612	rundll32.exe
Token: SeIncreaseQuotaPrivilege	2612	rundll32.exe
Token: 33	2612	rundll32.exe
Token: SeManageVolumePrivilege	2612	rundll32.exe
Token: SeProfSingleProcessPrivilege	2612	rundll32.exe
Token: SeRestorePrivilege	2612	rundll32.exe
Token: SeSecurityPrivilege	2612	rundll32.exe
Token: SeSystemProfilePrivilege	2612	rundll32.exe
Token: SeTakeOwnershipPrivilege	2612	rundll32.exe
Token: SeShutdownPrivilege	2612	rundll32.exe
Token: SeBackupPrivilege	1592	vssvc.exe
Token: SeRestorePrivilege	1592	vssvc.exe
Token: SeAuditPrivilege	1592	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 2612	3812	rundll32.exe	69
PID 3812 wrote to memory of 2612	3812	rundll32.exe	69
PID 3812 wrote to memory of 2612	3812	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70344ece62a828c46ff315b3328125d8ab5f6902bbeaa24224fee97142ee6ad9.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\70344ece62a828c46ff315b3328125d8ab5f6902bbeaa24224fee97142ee6ad9.bin.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2612

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592

memory/2612-117-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/2612-116-0x0000000003363000-0x0000000003365000-memory.dmp

Filesize
8KB

Download