3ca27b767922ee1a360c81c8c6cd1e10c52c8e502476ecc19c6d4667e3bbec18

Analysis

max time kernel
196s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 14:10

Target

3ca27b767922ee1a360c81c8c6cd1e10c52c8e502476ecc19c6d4667e3bbec18.dll
Size

397KB
MD5

7196e3ceb651bcf701f33ba975054bbf
SHA1

ad8ab3bf3bb08bca42f04371abe703e77e6703c7
SHA256

3ca27b767922ee1a360c81c8c6cd1e10c52c8e502476ecc19c6d4667e3bbec18
SHA512

45f614cdef3d2527182c3403c64c2ce27512f05dd3fcca4e1013a9caf8d74338c496aad297135c40a4c07309c8180b66c22dacdb27bcc7aaf058ea55e10897bf
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaU:174g2LDeiPDImOkx2LIaU

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1208	rundll32.exe
Token: SeTcbPrivilege	1208	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 1208	656	rundll32.exe	85
PID 656 wrote to memory of 1208	656	rundll32.exe	85
PID 656 wrote to memory of 1208	656	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ca27b767922ee1a360c81c8c6cd1e10c52c8e502476ecc19c6d4667e3bbec18.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ca27b767922ee1a360c81c8c6cd1e10c52c8e502476ecc19c6d4667e3bbec18.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1208