27784f24a8d0b693b96e57355c6eab3e56f2b6909cf74154393fdb6ee9ac6d17

Analysis

max time kernel
112s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 18:37

Target

冰封免费版(请关闭杀毒软件下载)/ty.dll
Size

372KB
MD5

6a6fcfdc2ad43d19e3299918a8845e84
SHA1

a66030d34e3357e00181241d48e8302a0a4e2098
SHA256

37e79983cde9c2f70fd73077dd7fafb944ec053f87976c6b33821b67001f0313
SHA512

495fb60dec4a65f7de72893049f46529f70bbb0eb852feab6c75f9998453413c1dc78b6779d3c55e9510ca40457c09b812b414edf4188e136f6f4ffd5c20b2e8
SSDEEP

6144:uz2R08dAbIs+orwFxCo0kNYXXGmo9TsrnpWh5G/ho0q4X/ieoNw4guSf629uCKPT:rRmIsgDOqOAyRGCVt/omrMc034jyXz02

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 1504 rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1504	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2324 wrote to memory of 1504	2324	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 1504	2324	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 1504	2324	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\ty.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\ty.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1504