ce58134c48382e27b590f510e02e20e59654f68dff7930c47765268401a1c86e

Analysis

max time kernel
126s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 11:35

Target

ce58134c48382e27b590f510e02e20e59654f68dff7930c47765268401a1c86e.dll
Size

397KB
MD5

c0797f8514c57812de511ee84cf8533b
SHA1

78b1a7ffc536e3bd6db4bbe23b7c96bf2d203438
SHA256

ce58134c48382e27b590f510e02e20e59654f68dff7930c47765268401a1c86e
SHA512

4ce65bfb23cfb701bd47010f94dd1ae8c83e4473e2101c33c3776d836e0a9ce76e6ec884b2c9bc70fb152bd096db4f80d3f18fa2e4f5e7ea373494f608167316
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa4:174g2LDeiPDImOkx2LIa4

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	rundll32.exe
Token: SeTcbPrivilege	1856	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1856	4348	rundll32.exe	88
PID 4348 wrote to memory of 1856	4348	rundll32.exe	88
PID 4348 wrote to memory of 1856	4348	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce58134c48382e27b590f510e02e20e59654f68dff7930c47765268401a1c86e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce58134c48382e27b590f510e02e20e59654f68dff7930c47765268401a1c86e.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856