b6d631a98b3bf0033ddc371e75ec7617cb6a10b7383dd4df60da0c9fa54a9cc4

Analysis

max time kernel
151s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2024 11:54

Target

b6d631a98b3bf0033ddc371e75ec7617cb6a10b7383dd4df60da0c9fa54a9cc4.dll
Size

397KB
MD5

eab38a227072b2499766294774b44638
SHA1

eb24ae3f8951f08a45d814af92251d2cfbc2b7d2
SHA256

b6d631a98b3bf0033ddc371e75ec7617cb6a10b7383dd4df60da0c9fa54a9cc4
SHA512

ed7e5f0d5975f420c4ee66ae8ab44dda6aaa52e5832c54590af55e94dea05f44125cebece66fbf48f81c11a4674dba2bc0258bc103f9d09d367eaf02f6acb0a5
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaK:174g2LDeiPDImOkx2LIaK

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
52	4296	rundll32.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	114.114.114.114

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4296	rundll32.exe
Token: SeTcbPrivilege	4296	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 4296	3548	rundll32.exe	91
PID 3548 wrote to memory of 4296	3548	rundll32.exe	91
PID 3548 wrote to memory of 4296	3548	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6d631a98b3bf0033ddc371e75ec7617cb6a10b7383dd4df60da0c9fa54a9cc4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6d631a98b3bf0033ddc371e75ec7617cb6a10b7383dd4df60da0c9fa54a9cc4.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4296