e6f2e463ffad30da47f8561d2c9d125b406ba693d9dda5b665995df73b2e5eb5

Analysis

max time kernel
154s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 11:41

Target

e6f2e463ffad30da47f8561d2c9d125b406ba693d9dda5b665995df73b2e5eb5.dll
Size

397KB
MD5

969317b2e82a7e5f8502a27bc38563b4
SHA1

f9f87f9c46fdce01cdfed24eb6273244578a2670
SHA256

e6f2e463ffad30da47f8561d2c9d125b406ba693d9dda5b665995df73b2e5eb5
SHA512

27141c9dd0f027da10ca3fc9678f6e5b6a4bc4f3287b3ff0252a37766936d16a3df09ae8cbbfebe8c7e947b730ff30a7c5f4eecffa64da074bf2644678a78b5f
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOal:174g2LDeiPDImOkx2LIal

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	rundll32.exe
Token: SeTcbPrivilege	544	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 544	1444	rundll32.exe	87
PID 1444 wrote to memory of 544	1444	rundll32.exe	87
PID 1444 wrote to memory of 544	1444	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6f2e463ffad30da47f8561d2c9d125b406ba693d9dda5b665995df73b2e5eb5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6f2e463ffad30da47f8561d2c9d125b406ba693d9dda5b665995df73b2e5eb5.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:544