0dd46adea805a907e8b7df3ef8804f6c057b7a17fe63890d79f1d84b23779f1e

Analysis

max time kernel
138s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 12:21

Target

0dd46adea805a907e8b7df3ef8804f6c057b7a17fe63890d79f1d84b23779f1e.dll
Size

397KB
MD5

abf31f5142f006b319ddf2d72bdf250a
SHA1

30997fd99925c327041eb9c354bdc2b2d1f2e573
SHA256

0dd46adea805a907e8b7df3ef8804f6c057b7a17fe63890d79f1d84b23779f1e
SHA512

aa60533db52c3a23a9339bd8110618b9beecdbd367ae0dfad69c9b4f9a5fd8bcb46567d7f02d63d3d5310628494d096c0ddaffde3bc34fc231a7289f4bef7fb0
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa4:174g2LDeiPDImOkx2LIa4

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	rundll32.exe
Token: SeTcbPrivilege	1976	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1976	2412	rundll32.exe	12
PID 2412 wrote to memory of 1976	2412	rundll32.exe	12
PID 2412 wrote to memory of 1976	2412	rundll32.exe	12

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dd46adea805a907e8b7df3ef8804f6c057b7a17fe63890d79f1d84b23779f1e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412