2d8d71b843abfadd7bf8b0a3a7465bf98efb4a7700427bcb0d738aa27db64513

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2023, 23:49

Target

2d8d71b843abfadd7bf8b0a3a7465bf98efb4a7700427bcb0d738aa27db64513.dll
Size

4.6MB
MD5

9977a1a27f5dd93d08990e9296d7cd78
SHA1

10d3d3202b3e6f0952ec3e62fd38c451bd4c15aa
SHA256

2d8d71b843abfadd7bf8b0a3a7465bf98efb4a7700427bcb0d738aa27db64513
SHA512

296d439324c702953715e9894539738ed08e9a4c023bbbd172f3076b0013b5bf2dff3f26644cd019d4a25bd0625e423d2081959dbde2f92955b35aad1efb97f3
SSDEEP

49152:LjO0UQjYtj7iH9WbOP27f02k529K0Md9qkTUnZUlQ4bl1o7ZJgCshkOTdpL2Y:Lj7YKcDh9Kjd9q6eZc9blMJE

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1944	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 1944	3292	rundll32.exe	86
PID 3292 wrote to memory of 1944	3292	rundll32.exe	86
PID 3292 wrote to memory of 1944	3292	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d8d71b843abfadd7bf8b0a3a7465bf98efb4a7700427bcb0d738aa27db64513.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d8d71b843abfadd7bf8b0a3a7465bf98efb4a7700427bcb0d738aa27db64513.dll,#1
  2⤵
  PID:1944

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944

memory/1944-0-0x00000000029B0000-0x0000000002EF2000-memory.dmp

Filesize
5.3MB

Download
memory/1944-1-0x0000027ECD360000-0x0000027ECD370000-memory.dmp

Filesize
64KB

Download
memory/1944-17-0x0000027ECD460000-0x0000027ECD470000-memory.dmp

Filesize
64KB

Download
memory/1944-33-0x0000027ED57D0000-0x0000027ED57D1000-memory.dmp

Filesize
4KB

Download
memory/1944-35-0x0000027ED5800000-0x0000027ED5801000-memory.dmp

Filesize
4KB

Download
memory/1944-36-0x0000027ED5800000-0x0000027ED5801000-memory.dmp

Filesize
4KB

Download
memory/1944-37-0x0000027ED5910000-0x0000027ED5911000-memory.dmp

Filesize
4KB

Download