bd723186450122632a1d8e803d180488fc774ad04e8bf284d7bb25d73363d576

Analysis

max time kernel
153s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 11:22

Target

bd723186450122632a1d8e803d180488fc774ad04e8bf284d7bb25d73363d576.dll
Size

397KB
MD5

073380022127073a92097a4881958bf8
SHA1

cbf0980f8276855c2695dea06612c883a1416031
SHA256

bd723186450122632a1d8e803d180488fc774ad04e8bf284d7bb25d73363d576
SHA512

44acec16a94b9e9fcd57d97bae4ce155b46c141aebadc4636e1e08b5dd65ace447639bb328c5fcfca7158c5d19122c1ce78136ba1bc55a085815e9f3493d0b17
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaZ:174g2LDeiPDImOkx2LIaZ

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2128	rundll32.exe
Token: SeTcbPrivilege	2128	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 2128	1172	rundll32.exe	16
PID 1172 wrote to memory of 2128	1172	rundll32.exe	16
PID 1172 wrote to memory of 2128	1172	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd723186450122632a1d8e803d180488fc774ad04e8bf284d7bb25d73363d576.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd723186450122632a1d8e803d180488fc774ad04e8bf284d7bb25d73363d576.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2128