616415e9b7a2ed2d37d69d8a669c3465bac2e4722fbd00858372d4136184a22d

Analysis

max time kernel
151s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 12:43

Target

616415e9b7a2ed2d37d69d8a669c3465bac2e4722fbd00858372d4136184a22d.dll
Size

397KB
MD5

e1ab52defbc695c191eae0ffbf216b0b
SHA1

39f903249cba8f6b44f619446524968de519b528
SHA256

616415e9b7a2ed2d37d69d8a669c3465bac2e4722fbd00858372d4136184a22d
SHA512

23ad685ae31e930d9839ebe41c3a0e376efe4df5636b69f1234cf22b4e5950deacd650cc18d95317559b5b99bfe11ff76640bb96dcf40cc99a342b072983c2a2
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa+:174g2LDeiPDImOkx2LIa+

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4240	rundll32.exe
Token: SeTcbPrivilege	4240	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4240	4560	rundll32.exe	88
PID 4560 wrote to memory of 4240	4560	rundll32.exe	88
PID 4560 wrote to memory of 4240	4560	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\616415e9b7a2ed2d37d69d8a669c3465bac2e4722fbd00858372d4136184a22d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\616415e9b7a2ed2d37d69d8a669c3465bac2e4722fbd00858372d4136184a22d.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4240