c4ab81d7b7d44dd6dfc4f2b69dbe3f22fbf23c1ae49ab8edac2d26f85ae4514d

Resubmissions

10-08-2023 17:03

10-08-2023 16:18

12-10-2021 18:50

12-10-2021 18:01

06-10-2021 20:46

05-10-2021 18:43

04-10-2021 21:53

max time kernel
1797s
max time network
1808s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2023 16:18

Target

ycof.dll
Size

1.1MB
MD5

54a3bcca6b1eb92adb299a46df941826
SHA1

6988e010056d88985b8e8f8de06706327779d3ca
SHA256

c4ab81d7b7d44dd6dfc4f2b69dbe3f22fbf23c1ae49ab8edac2d26f85ae4514d
SHA512

4e4f10abf8a97f649060cb3eaa125a487141a42b87d2dc1449d87531d927031279bd7b48a3859ffa8f5d4400deea77022ecb00c61de8511756dc9c0d27e3f150
SSDEEP

24576:I+Z6pjqiycCc0Ic7dYnG8896mYdB3g17yp/Xx3xShc1ZcQGcoCKVXUGGotVjYmM+:fY+ICc0t7iG88Rp7AfxBShc1ZcQGZlVx

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3992 set thread context of 4996 3992 rundll32.exe msiexec.exe

description	pid	process	target process
PID 3992 set thread context of 4996	3992	rundll32.exe	msiexec.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

rundll32.exe

description	pid	process
Token: SeShutdownPrivilege	3992	rundll32.exe
Token: SeCreatePagefilePrivilege	3992	rundll32.exe
Token: SeShutdownPrivilege	3992	rundll32.exe
Token: SeCreatePagefilePrivilege	3992	rundll32.exe
Token: SeShutdownPrivilege	3992	rundll32.exe
Token: SeCreatePagefilePrivilege	3992	rundll32.exe
Token: SeShutdownPrivilege	3992	rundll32.exe
Token: SeCreatePagefilePrivilege	3992	rundll32.exe
Token: SeShutdownPrivilege	3992	rundll32.exe
Token: SeCreatePagefilePrivilege	3992	rundll32.exe
Token: SeShutdownPrivilege	3992	rundll32.exe
Token: SeCreatePagefilePrivilege	3992	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1680 wrote to memory of 3992	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 3992	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 3992	1680	rundll32.exe	rundll32.exe
PID 3992 wrote to memory of 4996	3992	rundll32.exe	msiexec.exe
PID 3992 wrote to memory of 4996	3992	rundll32.exe	msiexec.exe
PID 3992 wrote to memory of 4996	3992	rundll32.exe	msiexec.exe
PID 3992 wrote to memory of 4996	3992	rundll32.exe	msiexec.exe
PID 3992 wrote to memory of 4996	3992	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ycof.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680

memory/3992-133-0x0000000074060000-0x0000000074A96000-memory.dmp

Filesize
10.2MB

Download
memory/3992-134-0x0000000074060000-0x0000000074A96000-memory.dmp

Filesize
10.2MB

Download
memory/3992-136-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/3992-135-0x0000000074060000-0x0000000074A96000-memory.dmp

Filesize
10.2MB

Download
memory/3992-137-0x0000000074060000-0x0000000074A96000-memory.dmp

Filesize
10.2MB

Download
memory/3992-138-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/3992-184-0x0000000074060000-0x0000000074A96000-memory.dmp

Filesize
10.2MB

Download
memory/4996-183-0x0000000000F10000-0x0000000000F3A000-memory.dmp

Filesize
168KB

Download
memory/4996-185-0x0000000000F10000-0x0000000000F3A000-memory.dmp

Filesize
168KB

Download
memory/4996-188-0x0000000000F10000-0x0000000000F3A000-memory.dmp

Filesize
168KB

Download
memory/4996-187-0x0000000000F10000-0x0000000000F3A000-memory.dmp

Filesize
168KB

Download
memory/4996-190-0x0000000000F10000-0x0000000000F3A000-memory.dmp

Filesize
168KB

Download