5bbab96d60704854efd8246a7d9371688b9102261544827fc8884126d70bcb3b

Analysis

max time kernel
126s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2023 01:32

Target

Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.x86.dll
Size

116KB
MD5

da5b87e7cbc4fff5cc2702b3bf48f372
SHA1

507ddc8dd092181e308c301808bbb30318344de9
SHA256

a4c9b29fe6208f8158bd8823c05b03706efcc68d3fb9411222e1b24a825482a3
SHA512

664d05c9436b9ba93b90fa7344947b1f692a22af01185969cc956cd32f4999b092a7fa60c86d89789044ce720fd26d5477e7098353f2f40f68b2bc3972cba95e
SSDEEP

3072:4nFNs9WVNFqUjej+dsPEeK9emP3V1CxibAN6PG4I40HxC5hypa5pZpPUIAMOVYYQ:0NsaFfSjj8PevCYVA

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	1488	rundll32.exe
Token: SeRestorePrivilege	1488	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 1488	3528	rundll32.exe	84
PID 3528 wrote to memory of 1488	3528	rundll32.exe	84
PID 3528 wrote to memory of 1488	3528	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Config\Plugins\FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw\Plugin.x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Config\Plugins\FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw\Plugin.x86.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1488