f288961dff2f16f61180170cfff4c1e8c301463372e5e679bfffbe5fe7cfb320

Analysis

max time kernel
143s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 12:04

Target

f288961dff2f16f61180170cfff4c1e8c301463372e5e679bfffbe5fe7cfb320.dll
Size

397KB
MD5

29d265bfb7ea0b84f6ecc5fa29cf6795
SHA1

63c9b0207c1053ba0d63b7bea51d02be219bba51
SHA256

f288961dff2f16f61180170cfff4c1e8c301463372e5e679bfffbe5fe7cfb320
SHA512

ba886b5852fe163c3ea1f4cbbe27db53d16d9d62e523d01e385351b7744c20feec2322e8a2c0b4189d6c06dc0376778d1e7737c18e67dad7bac32dd1b683941d
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa3:174g2LDeiPDImOkx2LIa3

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	rundll32.exe
Token: SeTcbPrivilege	4916	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 4916	1848	rundll32.exe	90
PID 1848 wrote to memory of 4916	1848	rundll32.exe	90
PID 1848 wrote to memory of 4916	1848	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f288961dff2f16f61180170cfff4c1e8c301463372e5e679bfffbe5fe7cfb320.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f288961dff2f16f61180170cfff4c1e8c301463372e5e679bfffbe5fe7cfb320.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4916