1728a077a3bcbf180d0c09aea0c77ed1f15574d2f451288e480158ca00686b25

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2023, 16:01

Target

1728a077a3bcbf180d0c09aea0c77ed1f15574d2f451288e480158ca00686b25.dll
Size

4.6MB
MD5

ce1d47446f018fa2a91f70db137ac929
SHA1

0ab8917d7c42384a68802b2a676422a68ed10e13
SHA256

1728a077a3bcbf180d0c09aea0c77ed1f15574d2f451288e480158ca00686b25
SHA512

3a8faad8183d445879459514fdf3bfeeba2f15132a58680d46c80eefbbfd5009cbc14386b99ab94106723b0ca85c6571a1bd000a6b1321d7f333e677f0a55176
SSDEEP

49152:YRjozbc5aBHDMk8gGzKL2faMIzZZsdZo/3KFu9J16X9gQT9L:3EE8gGY2faMaWdm36AJ1SKQT

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2596	rundll32.exe
2596	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	rundll32.exe
Token: SeDebugPrivilege	2596	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2596	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 2596	4312	rundll32.exe	84
PID 4312 wrote to memory of 2596	4312	rundll32.exe	84
PID 4312 wrote to memory of 2596	4312	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1728a077a3bcbf180d0c09aea0c77ed1f15574d2f451288e480158ca00686b25.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1728a077a3bcbf180d0c09aea0c77ed1f15574d2f451288e480158ca00686b25.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2596