6de347bcf06d4ea224173332c8b8df87203ac1bc35ff8943b71d96f68879ac9e

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 05:53

Target

6de347bcf06d4ea224173332c8b8df87203ac1bc35ff8943b71d96f68879ac9e.dll
Size

428KB
MD5

7d361bd90dd879094d20d453bb66e2ba
SHA1

af5b857b37706a23037189212deb67c52b7557d9
SHA256

6de347bcf06d4ea224173332c8b8df87203ac1bc35ff8943b71d96f68879ac9e
SHA512

9045da5fbf064bba8f4cb70e18ce3ea69827c0d2f08b60f3c2ff22047cebb626706ddde71f3a4754e0b5061f414f793dae29374eee55c7bcbd3558c09c3f90ed
SSDEEP

12288:/bhac3r0H/ImedYM2SE+IwHrnyQUEAsGFlEQdLsIGeRoeR9C:/bhac3r0fIx2od1GFNJsIGeRoU9C

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4248	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 2764	456	rundll32.exe	85
PID 456 wrote to memory of 2764	456	rundll32.exe	85
PID 456 wrote to memory of 2764	456	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6de347bcf06d4ea224173332c8b8df87203ac1bc35ff8943b71d96f68879ac9e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6de347bcf06d4ea224173332c8b8df87203ac1bc35ff8943b71d96f68879ac9e.dll,#1
  2⤵
  PID:2764

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4248

memory/4248-0-0x0000028637270000-0x0000028637280000-memory.dmp

Filesize
64KB

Download
memory/4248-16-0x0000028637370000-0x0000028637380000-memory.dmp

Filesize
64KB

Download
memory/4248-32-0x000002863F6E0000-0x000002863F6E1000-memory.dmp

Filesize
4KB

Download
memory/4248-34-0x000002863F710000-0x000002863F711000-memory.dmp

Filesize
4KB

Download
memory/4248-35-0x000002863F710000-0x000002863F711000-memory.dmp

Filesize
4KB

Download
memory/4248-36-0x000002863F820000-0x000002863F821000-memory.dmp

Filesize
4KB

Download