a598f3bfe6aade6181811e357e6552b2611a077e63d439071e1eae1cbbf551e0

Analysis

max time kernel
143s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 12:02

Target

a598f3bfe6aade6181811e357e6552b2611a077e63d439071e1eae1cbbf551e0.dll
Size

397KB
MD5

edb507cba5655fefd204fec5e1e78a90
SHA1

5fc7371b58d8ac572fe42d29b4576eb06cc9b236
SHA256

a598f3bfe6aade6181811e357e6552b2611a077e63d439071e1eae1cbbf551e0
SHA512

1a31d2806438fca05d1cbccde90c5392ffced7e11d67930c60b0ac2b5c88e66335db5a14f3d6f1cc8212b5109d5d5189f96cf019603c571792a847f1435badc6
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOan:174g2LDeiPDImOkx2LIan

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	rundll32.exe
Token: SeTcbPrivilege	2832	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2832	4564	rundll32.exe	14
PID 4564 wrote to memory of 2832	4564	rundll32.exe	14
PID 4564 wrote to memory of 2832	4564	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a598f3bfe6aade6181811e357e6552b2611a077e63d439071e1eae1cbbf551e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4564