5e3b785223ded8cc5ce1eadcc96f63821044ac29a10b4e1eecfce575cf25db38

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 19:35

Target

5e3b785223ded8cc5ce1eadcc96f63821044ac29a10b4e1eecfce575cf25db38.dll
Size

116KB
MD5

af431d64c660ef49df3d003d191202a2
SHA1

b7f167e40dba7ac5c6d7b33453835361575d1c32
SHA256

5e3b785223ded8cc5ce1eadcc96f63821044ac29a10b4e1eecfce575cf25db38
SHA512

fa84ec865ad74ce696f1fa098c4b480e79487c9bc79dd260be5e65f91e256d998e93d6644abc8e31c4036d49ae10eab76a314bbba798155aeef334afd896f76b
SSDEEP

1536:7q1ZL9HIoPtGhjARYsJLjeMoJ8ilh432CRSQG71f22:7O+oPtaAvmMbgQG7c

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3560	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1340	2084	rundll32.exe	89
PID 2084 wrote to memory of 1340	2084	rundll32.exe	89
PID 2084 wrote to memory of 1340	2084	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e3b785223ded8cc5ce1eadcc96f63821044ac29a10b4e1eecfce575cf25db38.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e3b785223ded8cc5ce1eadcc96f63821044ac29a10b4e1eecfce575cf25db38.dll,#1
  2⤵
  PID:1340

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3560

memory/3560-0-0x0000023120450000-0x0000023120460000-memory.dmp

Filesize
64KB

Download
memory/3560-16-0x0000023120550000-0x0000023120560000-memory.dmp

Filesize
64KB

Download
memory/3560-32-0x00000231288C0000-0x00000231288C1000-memory.dmp

Filesize
4KB

Download
memory/3560-34-0x00000231288F0000-0x00000231288F1000-memory.dmp

Filesize
4KB

Download
memory/3560-35-0x00000231288F0000-0x00000231288F1000-memory.dmp

Filesize
4KB

Download
memory/3560-36-0x0000023128A00000-0x0000023128A01000-memory.dmp

Filesize
4KB

Download