580799f4eaaa31f433b1ea1991818eec2e00e653cc0030e46ed93a43280ece9f

Analysis

max time kernel
183s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 09:20

Target

580799f4eaaa31f433b1ea1991818eec2e00e653cc0030e46ed93a43280ece9f.dll
Size

33KB
MD5

01b31745a59128af54875a96f778f151
SHA1

725c5db158b5358fb949e5460ef22914a06ad382
SHA256

580799f4eaaa31f433b1ea1991818eec2e00e653cc0030e46ed93a43280ece9f
SHA512

f280f20cba1e20db9fa9040c8b013f4a53e0d73fe690a0ebabde001dccc6b3cbfddc089ab602bfbee4cb9596f84d6ecb6903052d0faec03819f0d02c2065097b
SSDEEP

768:V+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:V+av6qZ4QxpP0AtNfRJ5BHxY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	620	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 620	2244	rundll32.exe	57
PID 2244 wrote to memory of 620	2244	rundll32.exe	57
PID 2244 wrote to memory of 620	2244	rundll32.exe	57

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\580799f4eaaa31f433b1ea1991818eec2e00e653cc0030e46ed93a43280ece9f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\580799f4eaaa31f433b1ea1991818eec2e00e653cc0030e46ed93a43280ece9f.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:620