0e6fb1deb44e03c974b04d714d74cd8cd97f8da30c88f068bb1f3eeaf6719625

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 07:16

Target

0e6fb1deb44e03c974b04d714d74cd8cd97f8da30c88f068bb1f3eeaf6719625.dll
Size

397KB
MD5

477afbe1a8c3c85efcc98adc4e7b254a
SHA1

6d14c0bbadd02a343321f8ee6ea07340ec09028f
SHA256

0e6fb1deb44e03c974b04d714d74cd8cd97f8da30c88f068bb1f3eeaf6719625
SHA512

0209af9f1933aedc01735c549f6a6eaf1818245cbabaaa18b392a57aec31741bf422ff4eea0696c72f1eb3692b79db70a9d867ad214ff88be4e381d6982e3749
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOay:174g2LDeiPDImOkx2LIay

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	rundll32.exe
Token: SeTcbPrivilege	2740	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 2740	1328	rundll32.exe	92
PID 1328 wrote to memory of 2740	1328	rundll32.exe	92
PID 1328 wrote to memory of 2740	1328	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e6fb1deb44e03c974b04d714d74cd8cd97f8da30c88f068bb1f3eeaf6719625.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e6fb1deb44e03c974b04d714d74cd8cd97f8da30c88f068bb1f3eeaf6719625.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2740