08d9cc9df0f3b1467038fc2921c6629998a5ee54e93f45687deedd4acdbbb73b

Analysis

max time kernel
65s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2023 00:39

Target

Android Image Kitchen/android_win_tools/cyggcc_s-1.dll
Size

112KB
MD5

d21bdafcd666f291a164438fa354cd13
SHA1

431f103773955a90520b8ff6013246eb640f70f8
SHA256

8198f4d1a5fa457c3d6e10f8a0763402780f445a3504df166f816f8ff0da2abe
SHA512

7338bab1816f28f679fcd5aad89b785c7d36f0551313b367001f7bc01ba7dc6a80ff7c4ba5a8d5a0730a598675e1f844b5c73c281e1d8d497911ae640516a8f5
SSDEEP

1536:Ix1g1cLZP7WJ1Eo6z/EnnNtqW9fFJqOCn/jOhGPO7/S2xBtDJi5xOg:YmaP7WJ1QjEnnq+fFU/iUG7/S0iHOg

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exe

description pid process

Token: SeRestorePrivilege 3520 rundll32.exe
Token: SeBackupPrivilege 3520 rundll32.exe
Token: SeDebugPrivilege 3520 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2340 wrote to memory of 3520	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 3520	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 3520	2340	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Android Image Kitchen\android_win_tools\cyggcc_s-1.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Android Image Kitchen\android_win_tools\cyggcc_s-1.dll",#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3520

memory/3520-133-0x000000005E230000-0x000000005E254000-memory.dmp

Filesize
144KB

Download
memory/3520-134-0x0000000061000000-0x00000000614F0000-memory.dmp

Filesize
4.9MB

Download