2bc78b2cb385b002ee7cf3406e93c7ee336765022f9c3298637dc6496d8fc2fe

Analysis

max time kernel
98s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 19:17

Target

츨12.16ɫ/츨12.16.dll
Size

372KB
MD5

6a6fcfdc2ad43d19e3299918a8845e84
SHA1

a66030d34e3357e00181241d48e8302a0a4e2098
SHA256

37e79983cde9c2f70fd73077dd7fafb944ec053f87976c6b33821b67001f0313
SHA512

495fb60dec4a65f7de72893049f46529f70bbb0eb852feab6c75f9998453413c1dc78b6779d3c55e9510ca40457c09b812b414edf4188e136f6f4ffd5c20b2e8
SSDEEP

6144:uz2R08dAbIs+orwFxCo0kNYXXGmo9TsrnpWh5G/ho0q4X/ieoNw4guSf629uCKPT:rRmIsgDOqOAyRGCVt/omrMc034jyXz02

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 3920 rundll32.exe

description	pid	process
Token: SeDebugPrivilege	3920	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3108 wrote to memory of 3920	3108	rundll32.exe	rundll32.exe
PID 3108 wrote to memory of 3920	3108	rundll32.exe	rundll32.exe
PID 3108 wrote to memory of 3920	3108	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.dll,#1
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3920