678565121ed8ea8f106d675442bff8a84707b827d06433498da5ae402f251bae

Analysis

max time kernel
140s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 15:06

Target

77d327f4458ae3d233b6347a46d599c9.dll
Size

7KB
MD5

77d327f4458ae3d233b6347a46d599c9
SHA1

c0c15cba61889524dd659473d4650ac9b25392b3
SHA256

678565121ed8ea8f106d675442bff8a84707b827d06433498da5ae402f251bae
SHA512

4cbd32920a232627dce3c5191dbba8f8e0a8c9fcf77d30412aba5ecf7de04021b02ad04c3acf1455fa29aa6f7b7799b8354dc89c239d6fb7626f32228d53fe5c
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWhbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPDq3qX5S2hV

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4776	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 2804	4648	rundll32.exe	60
PID 4648 wrote to memory of 2804	4648	rundll32.exe	60
PID 4648 wrote to memory of 2804	4648	rundll32.exe	60

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77d327f4458ae3d233b6347a46d599c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\77d327f4458ae3d233b6347a46d599c9.dll,#1
  2⤵
  PID:2804

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4776

memory/4776-0-0x000002AAC5140000-0x000002AAC5150000-memory.dmp

Filesize
64KB

Download
memory/4776-16-0x000002AAC5240000-0x000002AAC5250000-memory.dmp

Filesize
64KB

Download
memory/4776-32-0x000002AACD560000-0x000002AACD561000-memory.dmp

Filesize
4KB

Download
memory/4776-34-0x000002AACD590000-0x000002AACD591000-memory.dmp

Filesize
4KB

Download
memory/4776-35-0x000002AACD590000-0x000002AACD591000-memory.dmp

Filesize
4KB

Download
memory/4776-36-0x000002AACD6A0000-0x000002AACD6A1000-memory.dmp

Filesize
4KB

Download