5ab2a0efa6f22d7336dc70ec0a9a8ef981d6da5460e0b5a929a0ee635b5c1f5a

Analysis

max time kernel
150s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 12:02

Target

5ab2a0efa6f22d7336dc70ec0a9a8ef981d6da5460e0b5a929a0ee635b5c1f5a.dll
Size

397KB
MD5

15ec6d3f6522b73b093514ea56555a80
SHA1

a91481b1caa251596ed87875029933bc1db254ad
SHA256

5ab2a0efa6f22d7336dc70ec0a9a8ef981d6da5460e0b5a929a0ee635b5c1f5a
SHA512

9448d4313c0faf87dbdcf10fd426c6737f753feb6861fe0fb78c6f56946ca8751287a2b7856ef2d3912436a9fddca296c0406c0a0b324f654a3c67648bf77bef
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaf:174g2LDeiPDImOkx2LIaf

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	rundll32.exe
Token: SeTcbPrivilege	1568	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1568	2084	rundll32.exe	91
PID 2084 wrote to memory of 1568	2084	rundll32.exe	91
PID 2084 wrote to memory of 1568	2084	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ab2a0efa6f22d7336dc70ec0a9a8ef981d6da5460e0b5a929a0ee635b5c1f5a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ab2a0efa6f22d7336dc70ec0a9a8ef981d6da5460e0b5a929a0ee635b5c1f5a.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1568