927a25f702310ed2f50b9fa5367c3b236e442885ddc0dcc44e6a631a129675c9

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2024 11:33

Target

927a25f702310ed2f50b9fa5367c3b236e442885ddc0dcc44e6a631a129675c9.dll
Size

397KB
MD5

7dc4faa49e394a3cb48af185f6d19e05
SHA1

4e1c20da77283dfee8f2fcd06e2ec17eadeb58ea
SHA256

927a25f702310ed2f50b9fa5367c3b236e442885ddc0dcc44e6a631a129675c9
SHA512

fd530dcca1d82764deeeef327e49defd07ef2667b2ac5f6b6e2ddc8e67b0f270a634062a7ea258ac23855d46b8d63283042e4bf93d6e5ab84a7a96e598727384
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOag:174g2LDeiPDImOkx2LIag

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	rundll32.exe
Token: SeTcbPrivilege	1544	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 1544	2788	rundll32.exe	89
PID 2788 wrote to memory of 1544	2788	rundll32.exe	89
PID 2788 wrote to memory of 1544	2788	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\927a25f702310ed2f50b9fa5367c3b236e442885ddc0dcc44e6a631a129675c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\927a25f702310ed2f50b9fa5367c3b236e442885ddc0dcc44e6a631a129675c9.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1544