fede203cd32d0a24c555e6f733e7d9f6ce288daaf05b0e6dbb501959a06f3076

Analysis

max time kernel
142s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2023 14:14

Target

NEAS.fede203cd32d0a24c555e6f733e7d9f6ce288daaf05b0e6dbb501959a06f3076_JC.dll
Size

259KB
MD5

468a30b0ce4341cdf189b0b62a36182a
SHA1

4b9ef7d6d7293c1005dab86ca18d0881047cee93
SHA256

fede203cd32d0a24c555e6f733e7d9f6ce288daaf05b0e6dbb501959a06f3076
SHA512

dfefcfdf1aed06041b10da492b4396bb6af78730518af0738155d33175dbc7ef85d09d7f4ecd4fd45935124ca38bb0dc8fbd0ceeb8115d46794465a86b2e96fe
SSDEEP

6144:fJqVG5d1IpjyibgkTZI6jHID90ahdBXWH/:f3d6QevoxjBXQ

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 2772 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	2772	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.fede203cd32d0a24c555e6f733e7d9f6ce288daaf05b0e6dbb501959a06f3076_JC.dll,#1
1⤵
PID:2924

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772

memory/2772-0-0x000001FC84F40000-0x000001FC84F50000-memory.dmp

Filesize
64KB

Download
memory/2772-16-0x000001FC85040000-0x000001FC85050000-memory.dmp

Filesize
64KB

Download
memory/2772-32-0x000001FC8D370000-0x000001FC8D371000-memory.dmp

Filesize
4KB

Download
memory/2772-34-0x000001FC8D390000-0x000001FC8D391000-memory.dmp

Filesize
4KB

Download
memory/2772-35-0x000001FC8D390000-0x000001FC8D391000-memory.dmp

Filesize
4KB

Download
memory/2772-36-0x000001FC8D4B0000-0x000001FC8D4B1000-memory.dmp

Filesize
4KB

Download