2040fa6a3135b06cfa440353040e452cbef847b15b6e1ab05535a642f56f2caf

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2023, 16:05

Target

2040fa6a3135b06cfa440353040e452cbef847b15b6e1ab05535a642f56f2caf.dll
Size

4.6MB
MD5

c344f69d0822264c787c9455666ff753
SHA1

95b6ef41125c64ef8de292fbc02720aa38b2415a
SHA256

2040fa6a3135b06cfa440353040e452cbef847b15b6e1ab05535a642f56f2caf
SHA512

9c11df44a0d1c95dbfc29a59d392b7422500414c217d6fd22f33e579d1aa901c4d4cd10ac851832502a512a02dd0585d36167febd2ebd6b48c5543d1efe2c359
SSDEEP

49152:1KVs5HQoRTs9E1GDNtoXL6yOvncf55JGsfmiL113k+5uqiB:6Tn9E1GBtoXL6yqI5qsOi11zoq

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
792	rundll32.exe
792	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	792	rundll32.exe
Token: SeDebugPrivilege	792	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
792	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 792	4004	rundll32.exe	83
PID 4004 wrote to memory of 792	4004	rundll32.exe	83
PID 4004 wrote to memory of 792	4004	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2040fa6a3135b06cfa440353040e452cbef847b15b6e1ab05535a642f56f2caf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2040fa6a3135b06cfa440353040e452cbef847b15b6e1ab05535a642f56f2caf.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:792