c10d67ebaeeea80e2a0cb268093a94f9db17d3b017b907af9934c9d520e59300

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 21:04

Target

1c6edb44951b69ef3d0058acb650c03a.dll
Size

27KB
MD5

1c6edb44951b69ef3d0058acb650c03a
SHA1

307759db86699064e49e61ee42be37841b47bc88
SHA256

c10d67ebaeeea80e2a0cb268093a94f9db17d3b017b907af9934c9d520e59300
SHA512

419410524f48dd460588ab498aed726a122b1777e35a432026487aa6a16af9c1c4f9f65a57c745f3ff416e06bb8b9b33d2d36bf2ed5806a2741a864301c204d7
SSDEEP

384:Jt3x2xRplGg13x2xQfcNUi/Yzixt+oBUb0d+nW9u7PqS1:CbGgnfWUi2lg+nWUDn1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3172	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3172	2804	rundll32.exe	18
PID 2804 wrote to memory of 3172	2804	rundll32.exe	18
PID 2804 wrote to memory of 3172	2804	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c6edb44951b69ef3d0058acb650c03a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c6edb44951b69ef3d0058acb650c03a.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3172

memory/3172-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download