bdea64bb1735ba4f9cc3f0b9a8224d9718ff2bed5970ab779f33c81523382563

Analysis

max time kernel
181s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 21:17

Target

my eyes deceive_Data/Managed/System.Configuration.dll
Size

42KB
MD5

a8841ca20b0ef176cbe7e88ea7401cc8
SHA1

8e4a9f7fef53e53bd062a6add7e43d055ff9e485
SHA256

072b1a1c48998733a2d52e1ac53e2d8bd5c618eb4dd17638347a4d9494b08dd6
SHA512

ffba27866803a586d0963883a27da07731de1feb497189d90ccf3f9b6bc759b71ebe9a4a4428f17e8910e9813e6aada7c5a0f2cc3c43179b8e7070b352e55f6c
SSDEEP

384:HzC2yuMNMMZJN56g8mKo/hjp0r4ourMVSzciDqnjdiaFg9/Ses93HE7LDaXTSv/+:H/yP1Sm3ScrMdWgdVl93kZAarx2ZJS5

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1596	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\my eyes deceive_Data\Managed\System.Configuration.dll",#1
1⤵
PID:3384

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596

memory/1596-0-0x0000023F6E940000-0x0000023F6E950000-memory.dmp

Filesize
64KB

Download
memory/1596-16-0x0000023F6EA40000-0x0000023F6EA50000-memory.dmp

Filesize
64KB

Download
memory/1596-32-0x0000023F76D30000-0x0000023F76D31000-memory.dmp

Filesize
4KB

Download
memory/1596-34-0x0000023F76D60000-0x0000023F76D61000-memory.dmp

Filesize
4KB

Download
memory/1596-35-0x0000023F76D60000-0x0000023F76D61000-memory.dmp

Filesize
4KB

Download
memory/1596-36-0x0000023F76E70000-0x0000023F76E71000-memory.dmp

Filesize
4KB

Download