c1aa4886e64332097cbb38b945e216b027557a2dd5f870482b5abcd9a45fadea

Analysis

max time kernel
79s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2023, 17:20

Target

c1aa4886e64332097cbb38b945e216b027557a2dd5f870482b5abcd9a45fadea.dll
Size

163KB
MD5

17278c3f4e8bf56d9c1054f67f19b82c
SHA1

116dd7d4698e38f7fe87ce04808148393b7d1b43
SHA256

c1aa4886e64332097cbb38b945e216b027557a2dd5f870482b5abcd9a45fadea
SHA512

f65a81a7393265f249180060ee2cbb89bc2732f2198adb1ac336d33e3b93d9fbc3aae3b4de4789afdc43307e89f6e91dee121960c62390e4fdf343723447a8fc
SSDEEP

3072:ZwIlou75k4WvRcdqFfn7N1HGXyyf/dBWrr4IHtTBf9av9w956frbM:WKN75k1NFf7N1HGXyyN0IIHtTB41w9wD

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	rundll32.exe
Token: SeManageVolumePrivilege	648	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2040	2920	rundll32.exe	39
PID 2920 wrote to memory of 2040	2920	rundll32.exe	39
PID 2920 wrote to memory of 2040	2920	rundll32.exe	39

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1aa4886e64332097cbb38b945e216b027557a2dd5f870482b5abcd9a45fadea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1aa4886e64332097cbb38b945e216b027557a2dd5f870482b5abcd9a45fadea.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2040

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:648

memory/648-18-0x000001A5F4170000-0x000001A5F4180000-memory.dmp

Filesize
64KB

Download
memory/648-2-0x000001A5F4070000-0x000001A5F4080000-memory.dmp

Filesize
64KB

Download
memory/648-34-0x000001A5FC4E0000-0x000001A5FC4E1000-memory.dmp

Filesize
4KB

Download
memory/648-37-0x000001A5FC510000-0x000001A5FC511000-memory.dmp

Filesize
4KB

Download
memory/648-38-0x000001A5FC620000-0x000001A5FC621000-memory.dmp

Filesize
4KB

Download
memory/648-36-0x000001A5FC510000-0x000001A5FC511000-memory.dmp

Filesize
4KB

Download