4e1c9b8f81b230c70c7d8103466e67720f9f36a74856ce43b21b3d2f103bb1b5

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2023 00:58

Target

4e1c9b8f81b230c70c7d8103466e67720f9f36a74856ce43b21b3d2f103bb1b5.dll
Size

1011KB
MD5

28a770df046f49c708b6d0a93cc5db20
SHA1

58b3671543ae31525ae389f72cc22ae842b1776d
SHA256

4e1c9b8f81b230c70c7d8103466e67720f9f36a74856ce43b21b3d2f103bb1b5
SHA512

63848113a31c9a70a1e3c2dad14fcb335c178e6415d69a3b2638bbccb5fef39545c830d0c3ea8b822abbe59664246978e8a433e975ba26d454247cca4ddb4cf3
SSDEEP

24576:wSPT8YLiMihPM1x/19g4j0lmZyi4GAyC8TNXtN93:iXPwh11sXIAyT9tN93

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
11	2464	rundll32.exe
12	2464	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowSystemNewUpdate616.log	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2464	2468	rundll32.exe	81
PID 2468 wrote to memory of 2464	2468	rundll32.exe	81
PID 2468 wrote to memory of 2464	2468	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e1c9b8f81b230c70c7d8103466e67720f9f36a74856ce43b21b3d2f103bb1b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e1c9b8f81b230c70c7d8103466e67720f9f36a74856ce43b21b3d2f103bb1b5.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2464

memory/2464-0-0x00000000751A0000-0x00000000752A3000-memory.dmp

Filesize
1.0MB

Download
memory/2464-1-0x00000000751A0000-0x00000000752A3000-memory.dmp

Filesize
1.0MB

Download
memory/2464-6-0x00000000751A0000-0x00000000752A3000-memory.dmp

Filesize
1.0MB

Download