a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2023, 01:05

Target

a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a.dll
Size

3.6MB
MD5

a285d236f4bc221cae4f07407c6c4bb4
SHA1

7f85a28da3d659443e56892b5325eedc2702fabd
SHA256

a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a
SHA512

e4e3fdd3efb710a9a18c74f2329f5e75faf9a9483bad0c35999dcee952c5c532c15b66a5d2956d63753ee7770448323b42934a9b1dd1f48f0e289816ec375d53
SSDEEP

49152:tzzvNtsvz12Acn9CkZ0X2hff/yC3G/j111Y111D111CRB6+zINs4:pzjo1yrpR3f8111Y111D111k6+zINx

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowSystemNewUpdate44.log	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 3940	1376	rundll32.exe	84
PID 1376 wrote to memory of 3940	1376	rundll32.exe	84
PID 1376 wrote to memory of 3940	1376	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3940