a95f6fa65d3e3f976a516a72aceb2d555ac612507d30e638fc90ba5b1e4c00f6

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2023, 07:32

Target

a95f6fa65d3e3f976a516a72aceb2d555ac612507d30e638fc90ba5b1e4c00f6.dll
Size

2.2MB
MD5

5205ab3ff51ed2d398d2e85a7b912ecf
SHA1

56e180016ebff639dce200a24f467e65542e0210
SHA256

a95f6fa65d3e3f976a516a72aceb2d555ac612507d30e638fc90ba5b1e4c00f6
SHA512

e361f66115ec13e10d4a883835dd00040b345cf22d3df7b6780a849e1726b661b1795aae1a225ff21faa2313facde0c208f1993b5b78f543c382a432e1036891
SSDEEP

49152:hxgcCjAuGaCZoJiqEk7ZjC95NP3C4vTPUO5BqqxBJi9Kr:4jz0ZoJikjE5NP3dJLqqx

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2548	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 2328	3408	rundll32.exe	85
PID 3408 wrote to memory of 2328	3408	rundll32.exe	85
PID 3408 wrote to memory of 2328	3408	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a95f6fa65d3e3f976a516a72aceb2d555ac612507d30e638fc90ba5b1e4c00f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a95f6fa65d3e3f976a516a72aceb2d555ac612507d30e638fc90ba5b1e4c00f6.dll,#1
  2⤵
  PID:2328

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548

memory/2548-0-0x000002A270C90000-0x000002A270CA0000-memory.dmp

Filesize
64KB

Download
memory/2548-16-0x000002A270D90000-0x000002A270DA0000-memory.dmp

Filesize
64KB

Download
memory/2548-32-0x000002A279100000-0x000002A279101000-memory.dmp

Filesize
4KB

Download
memory/2548-34-0x000002A279130000-0x000002A279131000-memory.dmp

Filesize
4KB

Download
memory/2548-35-0x000002A279130000-0x000002A279131000-memory.dmp

Filesize
4KB

Download
memory/2548-36-0x000002A279240000-0x000002A279241000-memory.dmp

Filesize
4KB

Download