00c677f00271c62b827d1164620fde0d9a7ff7c60dec020a7bf476fa8f40e228

Analysis

max time kernel
138s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 13:11

Target

seeex/896.dd.02e87000_000a6400.dll
Size

665KB
MD5

f0e479fc7c254fac1b7ff99d9b35a41e
SHA1

9da583beff9bba9026a5c9973e28137075feaa90
SHA256

44464ad1d789b0978f33967b779c465a19735e7684452e0ba79a0e1da16c9a41
SHA512

ab25f02109fed54075075078762aad3759bf2c9d73677b6a9b2b0c92ce92fbc31190378ba3194b5e0c60bedc6946cc1d17617670ee21a281617954f3e7fa6dc7
SSDEEP

12288:cvEziMMHmcaZM16We4lBCi2cEMsA6MVxOv4iIJ:c8ziJGbZM1scBCi2cEIv

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 2864 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	2864	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\seeex\896.dd.02e87000_000a6400.dll,#1
1⤵
PID:3980

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2864

memory/2864-0-0x0000022E19B40000-0x0000022E19B50000-memory.dmp

Filesize
64KB

Download
memory/2864-16-0x0000022E19C40000-0x0000022E19C50000-memory.dmp

Filesize
64KB

Download
memory/2864-32-0x0000022E21F80000-0x0000022E21F81000-memory.dmp

Filesize
4KB

Download
memory/2864-34-0x0000022E21FB0000-0x0000022E21FB1000-memory.dmp

Filesize
4KB

Download
memory/2864-35-0x0000022E21FB0000-0x0000022E21FB1000-memory.dmp

Filesize
4KB

Download
memory/2864-36-0x0000022E220C0000-0x0000022E220C1000-memory.dmp

Filesize
4KB

Download