8de0faea4317622eb6c55b6415931fc38c1445fc8a3ed44116b8b266eb7e6c8d

Analysis

max time kernel
123s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2023, 18:48

Target

22e90687e97af13867f4c68e7d9deb40.dll
Size

212KB
MD5

22e90687e97af13867f4c68e7d9deb40
SHA1

fddbd2f2f86f2b98ce8777ba6900c59eef9158d9
SHA256

8de0faea4317622eb6c55b6415931fc38c1445fc8a3ed44116b8b266eb7e6c8d
SHA512

5f3d1d64d0f7efc5c6b4e3ad6e988f17f5b90e05464b87f988ea07b0421e1d1f9cd072b5c7ab07fb5e20fe8345e6c0ff8d2c7bbf4718c204ccc57f3e8a3c234a
SSDEEP

192:zwd2m0c36pZtQpK8F7benHk6flBzM1PeT+rm7VJ/2ski8D5AVZLpM+4kgUw9v:z47Va7qzaHJlBzMPeTeOVhxceZLhU

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
676	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5040	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5040	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 5040	3908	rundll32.exe	83
PID 3908 wrote to memory of 5040	3908	rundll32.exe	83
PID 3908 wrote to memory of 5040	3908	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22e90687e97af13867f4c68e7d9deb40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22e90687e97af13867f4c68e7d9deb40.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5040

memory/5040-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download