cf447525eae0e9aea9b61ccece2271ad764f4b5d33977c194e819700ff4c9086

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 14:06

Target

cf447525eae0e9aea9b61ccece2271ad764f4b5d33977c194e819700ff4c9086.dll
Size

397KB
MD5

30a7581a34e35668bed8f34ca56a8a9d
SHA1

39ae962a7f86e838e87ef1f84c2f52dbff5245d0
SHA256

cf447525eae0e9aea9b61ccece2271ad764f4b5d33977c194e819700ff4c9086
SHA512

2ee02b20d544b54573804e3baa84221fccf7a561559e2ddbb81bc20e24c3278b62e1596d649d6b2bbb49973058f90ebec1d506a9e2d0abb3c5d2b87b2bc5538b
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa+:174g2LDeiPDImOkx2LIa+

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1192	rundll32.exe
Token: SeTcbPrivilege	1192	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 1192	672	rundll32.exe	88
PID 672 wrote to memory of 1192	672	rundll32.exe	88
PID 672 wrote to memory of 1192	672	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf447525eae0e9aea9b61ccece2271ad764f4b5d33977c194e819700ff4c9086.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf447525eae0e9aea9b61ccece2271ad764f4b5d33977c194e819700ff4c9086.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1192