a0338bfe7ef14664641f87edcb71cc536ddc6d8ff795ce80666d8992dc136b39

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2023, 13:07

Target

a0338bfe7ef14664641f87edcb71cc536ddc6d8ff795ce80666d8992dc136b39.dll
Size

397KB
MD5

ab3fec1cd31454970cc9ff862528ec18
SHA1

15c754a6d655b1c01c1af7a60c0c3ce22e674730
SHA256

a0338bfe7ef14664641f87edcb71cc536ddc6d8ff795ce80666d8992dc136b39
SHA512

11941db101f9bce9007a784a63d1f82696ab5f6464b2c09a9eada320d532463e1aaabd52362bd33781a5719b89484c745347376f4c484b3822ff7c72b6dbb2fa
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa:174g2LDeiPDImOkx2LIa

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	rundll32.exe
Token: SeTcbPrivilege	5112	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 5112	3672	rundll32.exe	86
PID 3672 wrote to memory of 5112	3672	rundll32.exe	86
PID 3672 wrote to memory of 5112	3672	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0338bfe7ef14664641f87edcb71cc536ddc6d8ff795ce80666d8992dc136b39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0338bfe7ef14664641f87edcb71cc536ddc6d8ff795ce80666d8992dc136b39.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5112