08d9cc9df0f3b1467038fc2921c6629998a5ee54e93f45687deedd4acdbbb73b

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2023 00:39

Target

Android Image Kitchen/android_win_tools/cygcrypto-1.1.dll
Size

2.3MB
MD5

718ab5e025f2faf54d1bbfc932ba1005
SHA1

48ef46eff7255859f9186fed47173c8845918dd4
SHA256

ca84894cc271253fac04523250e95cf71499186543d3d7e22e7cc3e9aadeedd6
SHA512

cf0a85e21a17bbc8ffccef69fbc90f83ed82c0f50227b4d830c46efce30054d9608de1bb6538bc8c67a7a1a0f785bd05122fe2bfffb583c9104663a1435b6e1c
SSDEEP

49152:kyeWnbOuYLg92ppIJTHS+A06iDEXLkjvV+uVaBP4Etc//UoHepRaz91CPwDv3uFg:leWnbzYLg9gOTHS+A06VXLkjvV+uVaha

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exe

description pid process

Token: SeRestorePrivilege 3668 rundll32.exe
Token: SeBackupPrivilege 3668 rundll32.exe
Token: SeDebugPrivilege 3668 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 464 wrote to memory of 3668	464	rundll32.exe	rundll32.exe
PID 464 wrote to memory of 3668	464	rundll32.exe	rundll32.exe
PID 464 wrote to memory of 3668	464	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Android Image Kitchen\android_win_tools\cygcrypto-1.1.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Android Image Kitchen\android_win_tools\cygcrypto-1.1.dll",#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3668

memory/3668-134-0x000000005E230000-0x000000005E254000-memory.dmp

Filesize
144KB

Download
memory/3668-135-0x000000005A1B0000-0x000000005A1CE000-memory.dmp

Filesize
120KB

Download
memory/3668-133-0x000000005EA40000-0x000000005EC8E000-memory.dmp

Filesize
2.3MB

Download
memory/3668-136-0x0000000061000000-0x00000000614F0000-memory.dmp

Filesize
4.9MB

Download