2b5cb0072845e49f746f10d014daa15684776cb587f08a186d2bc84bcd23406c

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 12:20

Target

2b5cb0072845e49f746f10d014daa15684776cb587f08a186d2bc84bcd23406c.dll
Size

397KB
MD5

b6fc34bf4c2e542f364682aebf52544a
SHA1

cc1864cd772c19ae67919b32185e3f9a903543eb
SHA256

2b5cb0072845e49f746f10d014daa15684776cb587f08a186d2bc84bcd23406c
SHA512

1cc362bd02535f67e6af507439febf2072665e0bc3ec5a369dffe28b2f349502174e987619b4b18d927ef02356a1ba1835e552a68e70e1b1a81f2d6175cde04e
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaQ:174g2LDeiPDImOkx2LIaQ

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1128	rundll32.exe
Token: SeTcbPrivilege	1128	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1128	2440	rundll32.exe	62
PID 2440 wrote to memory of 1128	2440	rundll32.exe	62
PID 2440 wrote to memory of 1128	2440	rundll32.exe	62

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b5cb0072845e49f746f10d014daa15684776cb587f08a186d2bc84bcd23406c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b5cb0072845e49f746f10d014daa15684776cb587f08a186d2bc84bcd23406c.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1128