94d91032d0b36d553a1045e3aae365e13bd9d6d6a2fc4d0bb4fe722f31af904e

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2023 04:50

Target

94d91032d0b36d553a1045e3aae365e13bd9d6d6a2fc4d0bb4fe722f31af904e.dll
Size

259KB
MD5

b0c40e292dccaa0bd8b277404d58aae4
SHA1

381a80919c3920b9de1a05f5e9122d1086904b42
SHA256

94d91032d0b36d553a1045e3aae365e13bd9d6d6a2fc4d0bb4fe722f31af904e
SHA512

ee4dd99316610a29004ff14e791e3957f3be35603e18540b197b80f4661db18690fee38443f71f68eb3d78d4a3493a0ad7a89fcb3b24df9aff4d574b44dc583d
SSDEEP

6144:uJqVG5d1IpMyibgkTZI6jHID90abBXqH/:u3d6tevoxrBXc

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 740 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	740	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\94d91032d0b36d553a1045e3aae365e13bd9d6d6a2fc4d0bb4fe722f31af904e.dll,#1
1⤵
PID:4852

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:740

memory/740-0-0x000001BAA0B80000-0x000001BAA0B90000-memory.dmp

Filesize
64KB

Download
memory/740-16-0x000001BAA0C80000-0x000001BAA0C90000-memory.dmp

Filesize
64KB

Download
memory/740-32-0x000001BAA8FF0000-0x000001BAA8FF1000-memory.dmp

Filesize
4KB

Download
memory/740-34-0x000001BAA9020000-0x000001BAA9021000-memory.dmp

Filesize
4KB

Download
memory/740-35-0x000001BAA9020000-0x000001BAA9021000-memory.dmp

Filesize
4KB

Download
memory/740-36-0x000001BAA9130000-0x000001BAA9131000-memory.dmp

Filesize
4KB

Download