897743991b3fa7412676bf964bf2c285b918c4b312e88259507b1fa699713108

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 12:00

Target

897743991b3fa7412676bf964bf2c285b918c4b312e88259507b1fa699713108.dll
Size

397KB
MD5

a824672fe851b3dfa7d7784fdce21bd8
SHA1

c3f4c0586328738fc049b54063f8bbc800cef432
SHA256

897743991b3fa7412676bf964bf2c285b918c4b312e88259507b1fa699713108
SHA512

e175b85fed91f4a191e31f7d162d295ed4b3bec7263526eac309f10a537f3d7d61abbd6654af42e816c2a921ac6891c1b08c3fe8c14346d3e20b1c35d83ab49a
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaD:174g2LDeiPDImOkx2LIaD

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	rundll32.exe
Token: SeTcbPrivilege	5040	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 5040	4044	rundll32.exe	60
PID 4044 wrote to memory of 5040	4044	rundll32.exe	60
PID 4044 wrote to memory of 5040	4044	rundll32.exe	60

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\897743991b3fa7412676bf964bf2c285b918c4b312e88259507b1fa699713108.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\897743991b3fa7412676bf964bf2c285b918c4b312e88259507b1fa699713108.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5040