04ca3d994c23115cdb74614535683ae17ada863b83a14bce4f02917a63276d68

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 16:13

Target

04ca3d994c23115cdb74614535683ae17ada863b83a14bce4f02917a63276d68.dll
Size

397KB
MD5

5ee8037156c991f168b124addad38cc9
SHA1

6b453b87c23f785e7248a0eac0286056edf921f1
SHA256

04ca3d994c23115cdb74614535683ae17ada863b83a14bce4f02917a63276d68
SHA512

382e18e5c19a381500d8e0704fd95ec6bd1025d26495555c42171340c4a76bc79f6c792d790232312c6f407c72bec8f32cb2b5f8c68d0df0a5863df2ff4d77f0
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOab:174g2LDeiPDImOkx2LIab

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	rundll32.exe
Token: SeTcbPrivilege	1116	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 1116	228	rundll32.exe	87
PID 228 wrote to memory of 1116	228	rundll32.exe	87
PID 228 wrote to memory of 1116	228	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04ca3d994c23115cdb74614535683ae17ada863b83a14bce4f02917a63276d68.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04ca3d994c23115cdb74614535683ae17ada863b83a14bce4f02917a63276d68.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1116