81f3f238ff014ac37392557054441605cd63155be06bffe72f5abd834d340c5d

Analysis

max time kernel
167s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 21:36

Target

0498b74924f8ed2440cb73864f290a99.dll
Size

29KB
MD5

0498b74924f8ed2440cb73864f290a99
SHA1

1b45431216cdc847d893e322b1bdda5cd1700b8e
SHA256

81f3f238ff014ac37392557054441605cd63155be06bffe72f5abd834d340c5d
SHA512

ee9320093f43dfe42412f5842108f53dcb928242400b76f9885a1b4f861ca6a4074d41ca7535329421cc512eaca15e83fe613dd8b61e3d5cbe172d9988786aac
SSDEEP

192:AkNNbKK/h/22iK8gLBTq6C22ARcfFR8hPAMNqBJWUcJltGtftVri23pBRCBN8RYw:AKhHqchygKMNqBJkJliyN8gH7W4L0

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	824	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 824	3816	rundll32.exe	87
PID 3816 wrote to memory of 824	3816	rundll32.exe	87
PID 3816 wrote to memory of 824	3816	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0498b74924f8ed2440cb73864f290a99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0498b74924f8ed2440cb73864f290a99.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:824