b4349a8c55d2d364e52b485a9da36543afb172ab810bdf9df3d2998daa06e176

Analysis

max time kernel
97s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 19:23

Target

b4349a8c55d2d364e52b485a9da36543afb172ab810bdf9df3d2998daa06e176.dll
Size

83KB
MD5

2da3c812ce1c21ca1222ed4b2a0ae7e1
SHA1

fec1e001ef1bd8c69612fa99da9953d4050a2eac
SHA256

b4349a8c55d2d364e52b485a9da36543afb172ab810bdf9df3d2998daa06e176
SHA512

adc5195778f95d83affd3199faf2e4138da193e816eba30dd2abe47a177d368557b96ccae2960a7eeddcaaaf441b6591f32b9cc092bf594588d6ba32b5647755
SSDEEP

1536:iyXi33nrvbsTfvMtExf5strgV9JrnX6VG+GRi35LTapQb:i0WrknMOktrgJoG+GR85/apC

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4448	rundll32.exe
Token: SeIncBasePriorityPrivilege	4448	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 4448	1664	rundll32.exe	82
PID 1664 wrote to memory of 4448	1664	rundll32.exe	82
PID 1664 wrote to memory of 4448	1664	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4349a8c55d2d364e52b485a9da36543afb172ab810bdf9df3d2998daa06e176.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4349a8c55d2d364e52b485a9da36543afb172ab810bdf9df3d2998daa06e176.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4448