0809e48873261c7b611ba93c4d75c54d2969626ed1ca302b46059d30b5e789c2

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 14:13

Target

0809e48873261c7b611ba93c4d75c54d2969626ed1ca302b46059d30b5e789c2.dll
Size

397KB
MD5

0b5282693bbb7df2e8fbfd85ec4039c5
SHA1

d6f838da82132e7f7031ee93cababc38863ad344
SHA256

0809e48873261c7b611ba93c4d75c54d2969626ed1ca302b46059d30b5e789c2
SHA512

cf673a28cdba17ff97c10233595a4c266e5af88c95cc0f025508e55b89080390138da811044c26716e610faea5478ad441a00acdf9d8def72bd7ff15970ec993
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaP:174g2LDeiPDImOkx2LIaP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3948	rundll32.exe
Token: SeTcbPrivilege	3948	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 3948	3636	rundll32.exe	87
PID 3636 wrote to memory of 3948	3636	rundll32.exe	87
PID 3636 wrote to memory of 3948	3636	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0809e48873261c7b611ba93c4d75c54d2969626ed1ca302b46059d30b5e789c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0809e48873261c7b611ba93c4d75c54d2969626ed1ca302b46059d30b5e789c2.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3948