c62738dba2a254b58b63a3392e6dbd677aa0a68b7adfc3c06b55235343fdb1b4

Analysis

max time kernel
136s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2022, 23:00

Target

c62738dba2a254b58b63a3392e6dbd677aa0a68b7adfc3c06b55235343fdb1b4.dll
Size

22KB
MD5

c2458f9f4160e6172be218b619d29353
SHA1

e51b61e75a10887f00e824e9d3493d71f21f3dd1
SHA256

c62738dba2a254b58b63a3392e6dbd677aa0a68b7adfc3c06b55235343fdb1b4
SHA512

4abb5c336a6c1d6d96fee60d4dbd1422212959b1cc645947d487f05a6257d56276d207c6efa9f1491955602d34c6ca86dbda1a8c576bf09bf72968efce447c1b
SSDEEP

384:2WNhLtujlmm99XKjKhkdRa9Gb4HXgQMht6a9rbrFxk639aXGxh9d:7PLts0g9pgo/HXwht6aJVxk63v

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4864	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4864	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4864	4884	rundll32.exe	80
PID 4884 wrote to memory of 4864	4884	rundll32.exe	80
PID 4884 wrote to memory of 4864	4884	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c62738dba2a254b58b63a3392e6dbd677aa0a68b7adfc3c06b55235343fdb1b4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c62738dba2a254b58b63a3392e6dbd677aa0a68b7adfc3c06b55235343fdb1b4.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4864

memory/4864-133-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download