741c49af3dbc11c14327bb7447dbade53f15cd59b17f1d359162d9ddbfdc1191

Analysis

max time kernel
112s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 08:39

Target

741c49af3dbc11c14327bb7447dbade53f15cd59b17f1d359162d9ddbfdc1191.dll
Size

102KB
MD5

256469662c493731d4ceb003fc4783b1
SHA1

6793ee3fd9c1a4299c45029f0a71bf85525dca17
SHA256

741c49af3dbc11c14327bb7447dbade53f15cd59b17f1d359162d9ddbfdc1191
SHA512

56cbd63f885a01034c58e1d04c8bbce0aef8359bf513dd74ad45001e99b394cd8fde498adc021e2b22f4f0c4b2606596ba411763fb307debe97b81a877ea1ea9
SSDEEP

3072:jet1Bl/S0S9kN2HL/HBB41GAVCQVHPzL:jG3S0R2HLhBVAVCg

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2320	regsvr32.exe
Token: SeRestorePrivilege	2320	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 2320	4788	regsvr32.exe	81
PID 4788 wrote to memory of 2320	4788	regsvr32.exe	81
PID 4788 wrote to memory of 2320	4788	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\741c49af3dbc11c14327bb7447dbade53f15cd59b17f1d359162d9ddbfdc1191.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\741c49af3dbc11c14327bb7447dbade53f15cd59b17f1d359162d9ddbfdc1191.dll
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2320