429b52194700375984c7a5a46891dd037292f643478d10ec7d9393611f022ada

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2023, 10:00

Target

429b52194700375984c7a5a46891dd037292f643478d10ec7d9393611f022ada.dll
Size

808KB
MD5

62e5dd45f640592d499c3bd649155ea6
SHA1

c3fc76a3b16eebe9eb46e425aa2d703f9a690b0f
SHA256

429b52194700375984c7a5a46891dd037292f643478d10ec7d9393611f022ada
SHA512

19d73e0fbc198de200af927ca8d6c4b058ba65f32fe26b38da8e3789ce62a947a7149343dc669c9d63c9b05424517cc168ed05ea664334ac863076559a877c2a
SSDEEP

12288:+keL8xF5NyujYjHrWmtH77uuo3QsQ110qdrRodJAou33QzkYBf7a/CziwgHy:+keL3KmtH7Sb3Uv8JA5nQBBf7aqijS

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1648	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 4800	4240	rundll32.exe	82
PID 4240 wrote to memory of 4800	4240	rundll32.exe	82
PID 4240 wrote to memory of 4800	4240	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\429b52194700375984c7a5a46891dd037292f643478d10ec7d9393611f022ada.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\429b52194700375984c7a5a46891dd037292f643478d10ec7d9393611f022ada.dll,#1
  2⤵
  PID:4800

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1648

memory/1648-0-0x000001D57F740000-0x000001D57F750000-memory.dmp

Filesize
64KB

Download
memory/1648-16-0x000001D57F840000-0x000001D57F850000-memory.dmp

Filesize
64KB

Download
memory/1648-32-0x000001D57FB70000-0x000001D57FB71000-memory.dmp

Filesize
4KB

Download
memory/1648-34-0x000001D57FBA0000-0x000001D57FBA1000-memory.dmp

Filesize
4KB

Download
memory/1648-35-0x000001D57FBA0000-0x000001D57FBA1000-memory.dmp

Filesize
4KB

Download
memory/1648-36-0x000001D57FCB0000-0x000001D57FCB1000-memory.dmp

Filesize
4KB

Download