23ad5459c4b0fc72f7e651828840eb0057437fc02b2473f32e6a975c465fa01f

Analysis

max time kernel
166s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 18:28

Target

00763e33fc40bd5e44ec29dff0ad379b.dll
Size

172KB
MD5

00763e33fc40bd5e44ec29dff0ad379b
SHA1

c4664a4a91e621035f5ff81c7bfbf5cf1f18ea5d
SHA256

23ad5459c4b0fc72f7e651828840eb0057437fc02b2473f32e6a975c465fa01f
SHA512

795ac8598c2afc06cb535676ec85b8bf92a5031fc2cd210bca8f877d6881170833aad0e71a71d6e4be446ce684af328792b47a175ad3d4c0594067cf667cfce6
SSDEEP

3072:hReZZ3vlHwYIu00MVkFLXQEFv05tuWGywg2DGmdU6ol1kkOsZQPl6fQDn08oJM2S:/eZ1lHaXOFLHFc5tBhskNZQwfQT08oJM

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 5064	1444	rundll32.exe	88
PID 1444 wrote to memory of 5064	1444	rundll32.exe	88
PID 1444 wrote to memory of 5064	1444	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00763e33fc40bd5e44ec29dff0ad379b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00763e33fc40bd5e44ec29dff0ad379b.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5064 -ip 5064
1⤵
PID:2984

memory/5064-0-0x0000000010000000-0x0000000010324000-memory.dmp

Filesize
3.1MB

Download
memory/5064-1-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/5064-2-0x0000000010000000-0x0000000010324000-memory.dmp

Filesize
3.1MB

Download
memory/5064-3-0x0000000010000000-0x0000000010324000-memory.dmp

Filesize
3.1MB

Download
memory/5064-4-0x0000000010000000-0x0000000010324000-memory.dmp

Filesize
3.1MB

Download
memory/5064-5-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download