08d9cc9df0f3b1467038fc2921c6629998a5ee54e93f45687deedd4acdbbb73b

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2023 00:39

Target

Android Image Kitchen/android_win_tools/cygiconv-2.dll
Size

1008KB
MD5

78c269ed2da2f2bb800a61fa31530065
SHA1

fb531ffdcd01d687260882dc0cbd6dce0ca81b58
SHA256

4115c42fa0e03263438ee80017e3f1151131191cfcd3f9419fa80a1d0a0e2964
SHA512

777b5ec7de792261a2a3bb82f2d015f283d8a7138c724d471835d742effd303ecec8b235772dfa7c4d157afb05aaf40ee58a1c4f922e7193b4b50618ef9c0b9e
SSDEEP

24576:GboBRoBAUZLYnwPKO6lbbTCpGavkg3NyeuQ6l9fHOfK:gBAUZLYwiO6UpGaXBuQQ9uK

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exe

description pid process

Token: SeRestorePrivilege 4164 rundll32.exe
Token: SeBackupPrivilege 4164 rundll32.exe
Token: SeDebugPrivilege 4164 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1836 wrote to memory of 4164	1836	rundll32.exe	rundll32.exe
PID 1836 wrote to memory of 4164	1836	rundll32.exe	rundll32.exe
PID 1836 wrote to memory of 4164	1836	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Android Image Kitchen\android_win_tools\cygiconv-2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Android Image Kitchen\android_win_tools\cygiconv-2.dll",#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4164

memory/4164-133-0x0000000061000000-0x00000000614F0000-memory.dmp

Filesize
4.9MB

Download
memory/4164-134-0x0000000061000000-0x00000000614F0000-memory.dmp

Filesize
4.9MB

Download