fd4bd7b12743825a73b5220aefe81911b6d2644af6805999e350e03b10c1f59b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 14:34

Target

fd4bd7b12743825a73b5220aefe81911b6d2644af6805999e350e03b10c1f59b.dll
Size

397KB
MD5

e0509e9f70f07e3e57752ee5da2dc013
SHA1

2c23a504aa96ca833a7e9b88015187c1bc4198a3
SHA256

fd4bd7b12743825a73b5220aefe81911b6d2644af6805999e350e03b10c1f59b
SHA512

005d1a0c5a11d94825a06b373dcf361d7b84d1bceb27159623fbcf6518db4719ce3c0cfb7a7f21220f38d22c092fe4a82ba5a1dd029928b43daf68587349a3eb
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa1:174g2LDeiPDImOkx2LIa1

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3616	rundll32.exe
Token: SeTcbPrivilege	3616	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 3616	3856	rundll32.exe	14
PID 3856 wrote to memory of 3616	3856	rundll32.exe	14
PID 3856 wrote to memory of 3616	3856	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd4bd7b12743825a73b5220aefe81911b6d2644af6805999e350e03b10c1f59b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3856