2f6aa723011a8615306823fa5d57d1c25c0dcc847187f3b73265776cfd63602d

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2023, 23:59

Target

2f6aa723011a8615306823fa5d57d1c25c0dcc847187f3b73265776cfd63602d.dll
Size

4.6MB
MD5

820fc5d1ec7553fea741b2811c47e937
SHA1

0ec7d84244f5e37bf62e43e58d60f09cf868695c
SHA256

2f6aa723011a8615306823fa5d57d1c25c0dcc847187f3b73265776cfd63602d
SHA512

76786cedeef4d1a5d7b62df7a77af3a1d8e7882c10b596f24b038f9d28c879d0e7d89ebedb617d094a12eab5b2bc82bbcc92d06d5d69174f91e0a853962c188b
SSDEEP

49152:+ZcP5u3RYiQH3kifUQzGC98+4CKs41EccMpPDgU1J0jRqkqUH6:tP5UFsUQzGa8+4Cy2spLN1Jxt

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3096	rundll32.exe
3096	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3096	rundll32.exe
Token: SeDebugPrivilege	3096	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3096	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3096	4816	rundll32.exe	83
PID 4816 wrote to memory of 3096	4816	rundll32.exe	83
PID 4816 wrote to memory of 3096	4816	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f6aa723011a8615306823fa5d57d1c25c0dcc847187f3b73265776cfd63602d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f6aa723011a8615306823fa5d57d1c25c0dcc847187f3b73265776cfd63602d.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3096