047e0e000a23ca3bb7eed6e985152aeb048ba7a8e0eb17770f3a698e75224902

Analysis

max time kernel
144s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2024 14:32

Target

047e0e000a23ca3bb7eed6e985152aeb048ba7a8e0eb17770f3a698e75224902.dll
Size

397KB
MD5

864919ddbb32a111e2ce33c92fae102f
SHA1

9f9168fb6fadd20f4b1416e81684888a64569f4b
SHA256

047e0e000a23ca3bb7eed6e985152aeb048ba7a8e0eb17770f3a698e75224902
SHA512

62e860bfeca7447f9014061d3932356a920dcb194b72072f8aa7383823c4bb62fabb43d4fa60efa44aced3757494a8805be9b0e4b5812c89a490818e5a991fa4
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaP:174g2LDeiPDImOkx2LIaP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3720	rundll32.exe
Token: SeTcbPrivilege	3720	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3720	4064	rundll32.exe	16
PID 4064 wrote to memory of 3720	4064	rundll32.exe	16
PID 4064 wrote to memory of 3720	4064	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\047e0e000a23ca3bb7eed6e985152aeb048ba7a8e0eb17770f3a698e75224902.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\047e0e000a23ca3bb7eed6e985152aeb048ba7a8e0eb17770f3a698e75224902.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3720