9396b5cefb15f72e27b83f62d2fa015209d262c25ececb5fd1759140ec30ca69

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 12:39

Target

9396b5cefb15f72e27b83f62d2fa015209d262c25ececb5fd1759140ec30ca69.dll
Size

397KB
MD5

99f9eb15d43d06725a83c4165be7e169
SHA1

570b3fcefc45c59d20034ff1b1e5927125fdfd95
SHA256

9396b5cefb15f72e27b83f62d2fa015209d262c25ececb5fd1759140ec30ca69
SHA512

a67dc13afa63c8ca70cfb4883915f6fbb72e3f7036a7387d1c4ade67093f9171d488f2461e806c889ad03f60301373e237b735ee7e80267886ef95e7aa11f135
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaH:174g2LDeiPDImOkx2LIaH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3748	rundll32.exe
Token: SeTcbPrivilege	3748	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3748	3100	rundll32.exe	87
PID 3100 wrote to memory of 3748	3100	rundll32.exe	87
PID 3100 wrote to memory of 3748	3100	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9396b5cefb15f72e27b83f62d2fa015209d262c25ececb5fd1759140ec30ca69.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9396b5cefb15f72e27b83f62d2fa015209d262c25ececb5fd1759140ec30ca69.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3748