2691c9f93f2967dc9da586dc695da48ed9e53a94b92f048a4eb6a741d89c37fe

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2023 07:33

Target

2691c9f93f2967dc9da586dc695da48ed9e53a94b92f048a4eb6a741d89c37fe.dll
Size

2.0MB
MD5

c7e181d2667d44872c80797c5bc6dcde
SHA1

9de25ebaf792c3a71441f36b53df7a62704c3493
SHA256

2691c9f93f2967dc9da586dc695da48ed9e53a94b92f048a4eb6a741d89c37fe
SHA512

a82ffab93aa3986d7f74380a26d27bea0484d80a8f98592c4abea6ab6135ae73f01015fbdd55bd3a5988995b136834ef65364c288d1c99e9ef12230f1382b3e1
SSDEEP

24576:IfinFDoMB/CRn5h6u9zMq0xn7fBwES4jXHiHgpPx/rIEKz7sOCDH/S/ow40Q5B2E:IaJ91CRn39zMPmACCNDKXsrD6NQ87CB

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
872	rundll32.exe
872	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 872	4644	rundll32.exe	85
PID 4644 wrote to memory of 872	4644	rundll32.exe	85
PID 4644 wrote to memory of 872	4644	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2691c9f93f2967dc9da586dc695da48ed9e53a94b92f048a4eb6a741d89c37fe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2691c9f93f2967dc9da586dc695da48ed9e53a94b92f048a4eb6a741d89c37fe.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:872

memory/872-0-0x0000000002B60000-0x0000000002BA0000-memory.dmp

Filesize
256KB

Download