b4c869c6acd21d5ff95aa0220740a19c7b972eb6855b6e6c27b67e37375280e4

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 19:51

Target

b4c869c6acd21d5ff95aa0220740a19c7b972eb6855b6e6c27b67e37375280e4.dll
Size

899KB
MD5

cb57106f37f8379567c29bc58812935d
SHA1

a427043fed08228e384c0c0c82f41651c79ee121
SHA256

b4c869c6acd21d5ff95aa0220740a19c7b972eb6855b6e6c27b67e37375280e4
SHA512

4a794a79d0cfdce2ba771506cdfe3290bd1034fd6f6cb5e3b2e15b5420e932ca934f76903bf1a048dd4c3df3b4d5023f0b6f200a21230c7efdededa3a13f45e8
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXP:7wqd87VP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3968	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2660	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 3968	212	rundll32.exe	85
PID 212 wrote to memory of 3968	212	rundll32.exe	85
PID 212 wrote to memory of 3968	212	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4c869c6acd21d5ff95aa0220740a19c7b972eb6855b6e6c27b67e37375280e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4c869c6acd21d5ff95aa0220740a19c7b972eb6855b6e6c27b67e37375280e4.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3968

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2660

memory/2660-0-0x0000022921140000-0x0000022921150000-memory.dmp

Filesize
64KB

Download
memory/2660-16-0x0000022921240000-0x0000022921250000-memory.dmp

Filesize
64KB

Download
memory/2660-32-0x00000229295A0000-0x00000229295A1000-memory.dmp

Filesize
4KB

Download
memory/2660-34-0x00000229295D0000-0x00000229295D1000-memory.dmp

Filesize
4KB

Download
memory/2660-36-0x00000229296E0000-0x00000229296E1000-memory.dmp

Filesize
4KB

Download
memory/2660-35-0x00000229295D0000-0x00000229295D1000-memory.dmp

Filesize
4KB

Download