6cbd4f78c092b497183ed937cd673af8483a0ead65e272df7950f3ef1eb19236

Analysis

max time kernel
148s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 11:29

Target

6cbd4f78c092b497183ed937cd673af8483a0ead65e272df7950f3ef1eb19236.dll
Size

397KB
MD5

a7d0ec0e53625671e1d8f0686de51b93
SHA1

a257bfb5e57474492d84e9690da3354bf41c9dcb
SHA256

6cbd4f78c092b497183ed937cd673af8483a0ead65e272df7950f3ef1eb19236
SHA512

92820adaddac15d08b676c66885a543db5bd84f88edd04aab2f2d2bf95e7c9df5ddefb11b7269d73fd5edad59a8ebb52008e7340adeb4e1fe5c669ed12bb9bff
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOai:174g2LDeiPDImOkx2LIai

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	rundll32.exe
Token: SeTcbPrivilege	4140	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 4140	1000	rundll32.exe	16
PID 1000 wrote to memory of 4140	1000	rundll32.exe	16
PID 1000 wrote to memory of 4140	1000	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cbd4f78c092b497183ed937cd673af8483a0ead65e272df7950f3ef1eb19236.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1000