c0d9c40228ce8737133de0fe948fadb2d0523f6a5f737621b1dc358d93601686

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 21:05

Target

c0d9c40228ce8737133de0fe948fadb2d0523f6a5f737621b1dc358d93601686.dll
Size

3.3MB
MD5

35106c0a97a75677ce62ea4f39d61e4c
SHA1

a7875d5b58c79e66d5a01ec78fae8091ed3658df
SHA256

c0d9c40228ce8737133de0fe948fadb2d0523f6a5f737621b1dc358d93601686
SHA512

6841085ccbd61e4296150cf178108ff491851c74f04b4fcf96846d87b7cae941181d460f8b70a813044fc0a187d140b72ed1bbd29a0f6ba54387164275a24d89
SSDEEP

49152:iXPwh11sXIAyT9tN93gs5SkP2lS1mdM03aT1Pfnp8+wINC0:qPs1sByTr5SQrWM03o1R8+wIN/

Score

8^/10

Blocklisted process makes network request 3 IoCs

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowSystemNewUpdate75.log	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1540	1268	rundll32.exe	85
PID 1268 wrote to memory of 1540	1268	rundll32.exe	85
PID 1268 wrote to memory of 1540	1268	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0d9c40228ce8737133de0fe948fadb2d0523f6a5f737621b1dc358d93601686.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0d9c40228ce8737133de0fe948fadb2d0523f6a5f737621b1dc358d93601686.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1540

memory/1540-0-0x0000000074E70000-0x0000000074F73000-memory.dmp

Filesize
1.0MB

Download
memory/1540-1-0x0000000074E70000-0x0000000074F73000-memory.dmp

Filesize
1.0MB

Download
memory/1540-5-0x0000000074E70000-0x0000000074F73000-memory.dmp

Filesize
1.0MB

Download
memory/1540-7-0x0000000074E70000-0x0000000074F73000-memory.dmp

Filesize
1.0MB

Download