da62a88ad49057a896bed83c4c9dbce22bd20daf05ce9c323f154d4a298a0d2f

Analysis

max time kernel
92s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 15:54

Target

da62a88ad49057a896bed83c4c9dbce22bd20daf05ce9c323f154d4a298a0d2f.dll
Size

33KB
MD5

07ce0ed38400bf2bd41859f69600383a
SHA1

9fcda664eb4d61337668b9ff94e3fd4cbcd1e553
SHA256

da62a88ad49057a896bed83c4c9dbce22bd20daf05ce9c323f154d4a298a0d2f
SHA512

6ff4341d59e481c81ca4c33ad1acf084182bc5b7c25491daa50758780f63f50c36bd27d96cd5694e612bb8494d6f3b741d49029db3ea0abbd4ff12aa316ebc36
SSDEEP

768:R+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:R+av6qZ4QxpP0AtNfRJ5BHxY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 4904	2560	rundll32.exe	82
PID 2560 wrote to memory of 4904	2560	rundll32.exe	82
PID 2560 wrote to memory of 4904	2560	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da62a88ad49057a896bed83c4c9dbce22bd20daf05ce9c323f154d4a298a0d2f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da62a88ad49057a896bed83c4c9dbce22bd20daf05ce9c323f154d4a298a0d2f.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4904