26b9dd60fab2a5b2238e07cd14333b7a485e79b24e61921973ea3ca1111688bb

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 11:08

Target

26b9dd60fab2a5b2238e07cd14333b7a485e79b24e61921973ea3ca1111688bb.dll
Size

397KB
MD5

a35716db638c5b67325a3873e41bba0d
SHA1

abe9ebe89a4c5d2fddb91cff1bddd0e831035fae
SHA256

26b9dd60fab2a5b2238e07cd14333b7a485e79b24e61921973ea3ca1111688bb
SHA512

f0824598130f01c9cb0754e757bf33645e525b9bda8f17e50212443317a049a9300132a2c33a39ff13c4dded165f66a7dd86e1d90408812e14654a25304d6891
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaL:174g2LDeiPDImOkx2LIaL

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	rundll32.exe
Token: SeTcbPrivilege	4924	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 4924	1508	rundll32.exe	14
PID 1508 wrote to memory of 4924	1508	rundll32.exe	14
PID 1508 wrote to memory of 4924	1508	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26b9dd60fab2a5b2238e07cd14333b7a485e79b24e61921973ea3ca1111688bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508