b6ac895ed1ca63f8d320a3c2a4cdb11b74ed5f910fd17c7013fddc51db918a99

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2023 02:45

Target

b6ac895ed1ca63f8d320a3c2a4cdb11b74ed5f910fd17c7013fddc51db918a99.dll
Size

259KB
MD5

094a80fcfe2ccd143c795a3d00e42db4
SHA1

bf93a75de1127a34d6481dfb73f235e4ac8d47c9
SHA256

b6ac895ed1ca63f8d320a3c2a4cdb11b74ed5f910fd17c7013fddc51db918a99
SHA512

9d1f30b65cc0179c596b0fdcad97741c0dd6a233852ef8a22d2ee4e4e4308b8015f0db9145fdf52dfcb70eaba675047b688fb25ff6ed1ee0b5721882a89d6f4e
SSDEEP

6144:uJqVG5d1IpMyibgkTZI6jHID90aIBXLH/:u3d6tevoxYBXr

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 2916 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	2916	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6ac895ed1ca63f8d320a3c2a4cdb11b74ed5f910fd17c7013fddc51db918a99.dll,#1
1⤵
PID:4296

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916

memory/2916-0-0x000002687A950000-0x000002687A960000-memory.dmp

Filesize
64KB

Download
memory/2916-16-0x000002687AA50000-0x000002687AA60000-memory.dmp

Filesize
64KB

Download
memory/2916-32-0x000002687EDC0000-0x000002687EDC1000-memory.dmp

Filesize
4KB

Download
memory/2916-34-0x000002687EDF0000-0x000002687EDF1000-memory.dmp

Filesize
4KB

Download
memory/2916-35-0x000002687EDF0000-0x000002687EDF1000-memory.dmp

Filesize
4KB

Download
memory/2916-36-0x000002687EF00000-0x000002687EF01000-memory.dmp

Filesize
4KB

Download