b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0

Analysis

max time kernel
145s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 11:58

Target

b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0.dll
Size

397KB
MD5

f19bbb56af51461046430a74d0d67655
SHA1

1ac809b04e7402c74cd8af92af20173e1c117286
SHA256

b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0
SHA512

e6d4bfa89d0bfcbed1d10762450d61dbca5bede3a7c69d225dbdf4f69e9cefc1e28435c8a2ca90d3966799efff90fb55d1887dd79fa352d4a82706d5d18618ac
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOar:174g2LDeiPDImOkx2LIar

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	rundll32.exe
Token: SeTcbPrivilege	4824	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4824	1936	rundll32.exe	14
PID 1936 wrote to memory of 4824	1936	rundll32.exe	14
PID 1936 wrote to memory of 4824	1936	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936