29b68a6fb578ead8872c6fb5a69f7a1c5c377577d8b13a3a61cf14753e3c9966

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 09:07

Target

13e30e6dc99edf4c823873505fcc108c.dll
Size

140KB
MD5

13e30e6dc99edf4c823873505fcc108c
SHA1

78ea5b58e2cbe146df076cfcda75288ce2f1f9fa
SHA256

29b68a6fb578ead8872c6fb5a69f7a1c5c377577d8b13a3a61cf14753e3c9966
SHA512

41d4f380bd60bcb37847011b9888527c31c328db9e85dc0f40add66f3f7eb4f2ee2eb82a1a042088a57e88ddb7ac06ca5c6f3d4250c1490c5bf2af16b0e61912
SSDEEP

3072:O3IPnKm0+7EFnnpJfWs+Vtt7aqcIe7HCjxUW99/1J5rUtbN:OoK5+7Ehf/+VjncHCP3bp

Score

4^/10

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~3\c801ccf505378328c4fde99cd6e03e31.pad	rundll32.exe
File created	C:\PROGRA~3\c801ccf505378328c4fde99cd6e03e31.pad	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1596	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1404	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1404	932	rundll32.exe	16
PID 932 wrote to memory of 1404	932	rundll32.exe	16
PID 932 wrote to memory of 1404	932	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13e30e6dc99edf4c823873505fcc108c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:1596

memory/1404-1-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/1404-0-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/1404-4-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download