9ec9c82c92bd33433f4f39d4b8ce68c83b9d176e08b9cba31b8d13bd697b81de

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 23:37

Target

9ec9c82c92bd33433f4f39d4b8ce68c83b9d176e08b9cba31b8d13bd697b81de.dll
Size

33KB
MD5

84e6669b062625c4bcedaac4d44c44d0
SHA1

8e1af8678af7e4f3deaa0512b2d7a85ca4d25578
SHA256

9ec9c82c92bd33433f4f39d4b8ce68c83b9d176e08b9cba31b8d13bd697b81de
SHA512

085cf1aa0633cbb8ade6e5872997aeeff5d35df93984bb041d87793761e6178019028ab84c3a239eaac5509d84581c4dac0b8d61da57f74d20ef3dd2824be26b
SSDEEP

768:J+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:J+av6qZ4QxpP0AtNfRJ5BHxY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4892	4920	rundll32.exe	84
PID 4920 wrote to memory of 4892	4920	rundll32.exe	84
PID 4920 wrote to memory of 4892	4920	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ec9c82c92bd33433f4f39d4b8ce68c83b9d176e08b9cba31b8d13bd697b81de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ec9c82c92bd33433f4f39d4b8ce68c83b9d176e08b9cba31b8d13bd697b81de.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4892

memory/4892-133-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download