1a99bc9357affa392b3f44d35432277e3ec4f648d305f8cea13fe7efa07d3892

Analysis

max time kernel
131s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 15:54

Target

1a99bc9357affa392b3f44d35432277e3ec4f648d305f8cea13fe7efa07d3892.dll
Size

33KB
MD5

6cf19418d849e8cfd79828e2b35d9de1
SHA1

61c753f2da293eeaef15584ec14ff1df08be3450
SHA256

1a99bc9357affa392b3f44d35432277e3ec4f648d305f8cea13fe7efa07d3892
SHA512

f1a3cdc35138eee46595c949dde0e73846597613148ddfd76b58ec06c30cf65308e038164ba9e14410b4cc2ce92dc554a55fc3b3e12924576af3bc185982f9c0
SSDEEP

768:f+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:f+av6qZ4QxpP0AtNfRJ5BHxY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2940	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2940	2280	rundll32.exe	82
PID 2280 wrote to memory of 2940	2280	rundll32.exe	82
PID 2280 wrote to memory of 2940	2280	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a99bc9357affa392b3f44d35432277e3ec4f648d305f8cea13fe7efa07d3892.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a99bc9357affa392b3f44d35432277e3ec4f648d305f8cea13fe7efa07d3892.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2940