b9058796ff99c43c664cbbd9cd2d05b04d902f4ef5023d97577aec2ac69dbe7e

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2023 02:31

Target

b9058796ff99c43c664cbbd9cd2d05b04d902f4ef5023d97577aec2ac69dbe7e.dll
Size

253KB
MD5

52a3b355a1fd715deeb69d82c77d8e62
SHA1

b763c54c350e37595966e0be5a69bcdcaa69fe50
SHA256

b9058796ff99c43c664cbbd9cd2d05b04d902f4ef5023d97577aec2ac69dbe7e
SHA512

4060dc612de629f6c3b66c89095e8ea96f9a6cc2dd688f8160788c38cf6c388f485dfc416f22541cb425e9c15b0fbc1ddb53294b37433e6a04b68e0e5028213b
SSDEEP

3072:tVVK6EINn6uiwi3FPE/gpBItBJxrj15qSIT9AtxLE6FDLwa2Gx4YJcVMjka+A:LVKwgcIpBItB/dqTGtDDhP4Cjg

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 2688 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	2688	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9058796ff99c43c664cbbd9cd2d05b04d902f4ef5023d97577aec2ac69dbe7e.dll,#1
1⤵
PID:1016

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2688

memory/2688-0-0x0000015269B40000-0x0000015269B50000-memory.dmp

Filesize
64KB

Download
memory/2688-16-0x0000015269C40000-0x0000015269C50000-memory.dmp

Filesize
64KB

Download
memory/2688-32-0x0000015271F40000-0x0000015271F41000-memory.dmp

Filesize
4KB

Download
memory/2688-34-0x0000015271F70000-0x0000015271F71000-memory.dmp

Filesize
4KB

Download
memory/2688-35-0x0000015271F70000-0x0000015271F71000-memory.dmp

Filesize
4KB

Download
memory/2688-36-0x0000015272080000-0x0000015272081000-memory.dmp

Filesize
4KB

Download