c1f8df8df15d535fe24126228ed72d2adc4c00ed09550c931435ae6411ffd8b1

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 15:50

Target

c1f8df8df15d535fe24126228ed72d2adc4c00ed09550c931435ae6411ffd8b1.dll
Size

397KB
MD5

50ddd04006f7aa0a1d17493c380751c9
SHA1

89dbbdab933c66239af3dd37f9e87223427276fa
SHA256

c1f8df8df15d535fe24126228ed72d2adc4c00ed09550c931435ae6411ffd8b1
SHA512

629e8ca10929a4b9cef0d831e1a63f4bb64646577f28cf13fa49df0f6757d4ceb96520cddc917f82c075e618944f504718fa3f56b60931cf3daae006d7484883
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOab:174g2LDeiPDImOkx2LIab

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	rundll32.exe
Token: SeTcbPrivilege	3936	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 3936	3852	rundll32.exe	14
PID 3852 wrote to memory of 3936	3852	rundll32.exe	14
PID 3852 wrote to memory of 3936	3852	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1f8df8df15d535fe24126228ed72d2adc4c00ed09550c931435ae6411ffd8b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3852