e301211387dd926b857cda487945640eaa0fd5f5bfe270ffdfece98c9e291a09

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2023 17:44

Target

2236-57-0x000007FEF4EF0000-0x000007FEF5979000-memory.dll
Size

10.5MB
MD5

16e6368206a817fe2cd1145598970017
SHA1

526558fb0ce8ca0862394789a608b9b4065dd376
SHA256

e301211387dd926b857cda487945640eaa0fd5f5bfe270ffdfece98c9e291a09
SHA512

a9227178d9a11946027247eff530c988fd2d76df99f40ec339d354acc0665458d1c7a0729383755c86908a091cf65e4a6eac5a6ea6a25d702ec08a867942ec44
SSDEEP

196608:ZM55ByuX9ZtViSxtEL8WXtB2kUw14bafo4BrWBvA9m8:WcutZtV5tWXtM2ELQW9Op

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 4500 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	4500	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2236-57-0x000007FEF4EF0000-0x000007FEF5979000-memory.dll,#1
1⤵
PID:2388

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4500

memory/4500-133-0x000002449B140000-0x000002449B150000-memory.dmp

Filesize
64KB

Download
memory/4500-149-0x000002449B240000-0x000002449B250000-memory.dmp

Filesize
64KB

Download
memory/4500-165-0x00000244A35A0000-0x00000244A35A1000-memory.dmp

Filesize
4KB

Download
memory/4500-167-0x00000244A35D0000-0x00000244A35D1000-memory.dmp

Filesize
4KB

Download
memory/4500-168-0x00000244A35D0000-0x00000244A35D1000-memory.dmp

Filesize
4KB

Download
memory/4500-169-0x00000244A36E0000-0x00000244A36E1000-memory.dmp

Filesize
4KB

Download