ed304a997b308a26d5f122b844438289ea7582df6842af2352af8aca01b1c039

Analysis

max time kernel
180s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:51

Target

ed304a997b308a26d5f122b844438289ea7582df6842af2352af8aca01b1c039.dll
Size

200KB
MD5

03b7af49735529ca340da6d557c0f65d
SHA1

d7eb5d013f1fabf38b8ad202f39746784d48e89a
SHA256

ed304a997b308a26d5f122b844438289ea7582df6842af2352af8aca01b1c039
SHA512

25214ba72fb4308bbde09d8156bc3686ba2e6181394a6518d6d1eaf95777539af429e3bde7bb85c3d85f3fbbb479453097c3dbd0897f825817619b400ec59fb3
SSDEEP

3072:fnF8LYF7C0Uoicer1twUYAQiZxSv1VDPqfgFFshInVJg021CeBExtlL2ZfWnw3Wd:vF8s7fUSeo6dh1CeBtXs0zqqDG6a+

Score

1^/10

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	628	rundll32.exe
Token: SeSecurityPrivilege	628	rundll32.exe
Token: SeTakeOwnershipPrivilege	628	rundll32.exe
Token: SeLoadDriverPrivilege	628	rundll32.exe
Token: SeSystemProfilePrivilege	628	rundll32.exe
Token: SeSystemtimePrivilege	628	rundll32.exe
Token: SeProfSingleProcessPrivilege	628	rundll32.exe
Token: SeIncBasePriorityPrivilege	628	rundll32.exe
Token: SeCreatePagefilePrivilege	628	rundll32.exe
Token: SeShutdownPrivilege	628	rundll32.exe
Token: SeDebugPrivilege	628	rundll32.exe
Token: SeSystemEnvironmentPrivilege	628	rundll32.exe
Token: SeRemoteShutdownPrivilege	628	rundll32.exe
Token: SeUndockPrivilege	628	rundll32.exe
Token: SeManageVolumePrivilege	628	rundll32.exe
Token: 33	628	rundll32.exe
Token: 34	628	rundll32.exe
Token: 35	628	rundll32.exe
Token: 36	628	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 628	2156	rundll32.exe	79
PID 2156 wrote to memory of 628	2156	rundll32.exe	79
PID 2156 wrote to memory of 628	2156	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed304a997b308a26d5f122b844438289ea7582df6842af2352af8aca01b1c039.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed304a997b308a26d5f122b844438289ea7582df6842af2352af8aca01b1c039.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:628

memory/628-133-0x0000000000AC0000-0x0000000000AF8000-memory.dmp

Filesize
224KB

Download