0f36a348241b311bd4ae2c06cbfe787307db8834ac98442a5f9816404cc99917

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 23:11

Target

0f36a348241b311bd4ae2c06cbfe787307db8834ac98442a5f9816404cc99917.dll
Size

50KB
MD5

323bed39d2b33de87d60adb1dcf2e930
SHA1

60a69b0c417dd4075716b1d05ba6b6fddd545991
SHA256

0f36a348241b311bd4ae2c06cbfe787307db8834ac98442a5f9816404cc99917
SHA512

be949bdcfcb58d91208a47e072784c3bd22a9f3a47ac5eeb2cde7e36f948925dbb736fa4a19be9bc667a88920a09940cb6c83b38509eb4c4caa51f4ac736d445
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5jJYH:W5ReWjTrW9rNPgYo5JYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2216	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	396	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 2216	556	rundll32.exe	84
PID 556 wrote to memory of 2216	556	rundll32.exe	84
PID 556 wrote to memory of 2216	556	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f36a348241b311bd4ae2c06cbfe787307db8834ac98442a5f9816404cc99917.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f36a348241b311bd4ae2c06cbfe787307db8834ac98442a5f9816404cc99917.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2216

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:396

memory/396-0-0x00000288B8950000-0x00000288B8960000-memory.dmp

Filesize
64KB

Download
memory/396-16-0x00000288B8A50000-0x00000288B8A60000-memory.dmp

Filesize
64KB

Download
memory/396-32-0x00000288C0DC0000-0x00000288C0DC1000-memory.dmp

Filesize
4KB

Download
memory/396-34-0x00000288C0DF0000-0x00000288C0DF1000-memory.dmp

Filesize
4KB

Download
memory/396-35-0x00000288C0DF0000-0x00000288C0DF1000-memory.dmp

Filesize
4KB

Download
memory/396-36-0x00000288C0F00000-0x00000288C0F01000-memory.dmp

Filesize
4KB

Download