8eb715203467b043edf434e67b5385002101a6986fc89ab79120e2513677f58e

Analysis

max time kernel
179s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 00:15

Target

0832863dacf913518f73e4af42b48545.dll
Size

10KB
MD5

0832863dacf913518f73e4af42b48545
SHA1

32800e0562ab4774fd9d53dc68cc7d1a02a125cd
SHA256

8eb715203467b043edf434e67b5385002101a6986fc89ab79120e2513677f58e
SHA512

9e7cba11b74092d9f7d975496f6086aae36c91cb3a146e3cd6b680e8f4d76d2225b2c1799f1039b5dd50994151e78764a5952b94b664dc798a74a8070c8116dd
SSDEEP

192:8L33pespvP7BB6NmbAiKQJluPEQAFYbTILsa1Skpx0vGuJDgzwsyKLTkgUw9o:czvP7BXKEleEbGbMLsKx0vRUClz

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2460	1220	rundll32.exe	72
PID 1220 wrote to memory of 2460	1220	rundll32.exe	72
PID 1220 wrote to memory of 2460	1220	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0832863dacf913518f73e4af42b48545.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0832863dacf913518f73e4af42b48545.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2460

memory/2460-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download