08c662b30ab9f9a555c2f720656ed45e1f293fc413eaf364e926d0f126152558

Analysis

max time kernel
149s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 12:00

Target

08c662b30ab9f9a555c2f720656ed45e1f293fc413eaf364e926d0f126152558.dll
Size

397KB
MD5

6995086a0ee7f36461d67fc481633d55
SHA1

3c200e2ed8553c3e33d422774bc31585ab77712e
SHA256

08c662b30ab9f9a555c2f720656ed45e1f293fc413eaf364e926d0f126152558
SHA512

4ca5cd368430ac3b6b81ec104c7edb9991cf72cdf1871e16baf406fbbee622a08abb39355ac94c754a73fb3191d2743d83362c3ea56cb8fbe1024785f79bdb35
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaJ:174g2LDeiPDImOkx2LIaJ

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4264	rundll32.exe
Token: SeTcbPrivilege	4264	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4264	4832	rundll32.exe	14
PID 4832 wrote to memory of 4264	4832	rundll32.exe	14
PID 4832 wrote to memory of 4264	4832	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08c662b30ab9f9a555c2f720656ed45e1f293fc413eaf364e926d0f126152558.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4832