3c4ceee9eb970ed22878d784e21bbd6f564cced7f9db5ee5b94096a0451ee722

Analysis

max time kernel
148s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 08:44

Target

3c4ceee9eb970ed22878d784e21bbd6f564cced7f9db5ee5b94096a0451ee722.dll
Size

397KB
MD5

ea06172ab253123170ddbf351d6bb5aa
SHA1

71aa6198d3725ae33a803836304c59cbc67b345b
SHA256

3c4ceee9eb970ed22878d784e21bbd6f564cced7f9db5ee5b94096a0451ee722
SHA512

01b1502bff006eb91940f82b883d8c64a3eace2ed9dbc77111a765cdaebbf6895655e7ea67a7d6ed79a794172a8352e78e1c5d0ce4dfc6edeb32c04530f0b999
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaM:174g2LDeiPDImOkx2LIaM

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	rundll32.exe
Token: SeTcbPrivilege	2168	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 2168	1160	rundll32.exe	14
PID 1160 wrote to memory of 2168	1160	rundll32.exe	14
PID 1160 wrote to memory of 2168	1160	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c4ceee9eb970ed22878d784e21bbd6f564cced7f9db5ee5b94096a0451ee722.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160