b01fdf2eb382761bb3ba76beb9a655617d1900b9b54f4584e7c18b29665d1253

Analysis

max time kernel
164s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 12:44

Target

b01fdf2eb382761bb3ba76beb9a655617d1900b9b54f4584e7c18b29665d1253.dll
Size

397KB
MD5

a961cc787020e60453437750405320e1
SHA1

92987d46fe3ec6d9e9d6dc32ef43015aa737bfff
SHA256

b01fdf2eb382761bb3ba76beb9a655617d1900b9b54f4584e7c18b29665d1253
SHA512

c8c4c2696b923f252e32a07fc8ee0ffb3de962c973a10c3067232a1689faf9954ea7ceada28d4da735f3eaf2978154da22a828fdf895a2f7d65f40fe4415c1f3
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa3:174g2LDeiPDImOkx2LIa3

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	rundll32.exe
Token: SeTcbPrivilege	1936	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 1936	3536	rundll32.exe	90
PID 3536 wrote to memory of 1936	3536	rundll32.exe	90
PID 3536 wrote to memory of 1936	3536	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b01fdf2eb382761bb3ba76beb9a655617d1900b9b54f4584e7c18b29665d1253.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b01fdf2eb382761bb3ba76beb9a655617d1900b9b54f4584e7c18b29665d1253.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1936