69cd040d27724d27285171085f96ba7d534a888f4710a36834cd2b2032631d17

Analysis

max time kernel
154s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 16:13

Target

69cd040d27724d27285171085f96ba7d534a888f4710a36834cd2b2032631d17.dll
Size

397KB
MD5

7ad1482ec70b272a3258b0e56c60c3ce
SHA1

4ff14106d88d347bf657ab407aa6170a3ee321b0
SHA256

69cd040d27724d27285171085f96ba7d534a888f4710a36834cd2b2032631d17
SHA512

9b7f72a24a7d3655879bca81968590fd3c70ce6ecf2b1d1cef9cc3b74a39cba4f95d58b4f6e747d8926b2a552e18acedb271d60a4805fcd40197593091ebdd58
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaX:174g2LDeiPDImOkx2LIaX

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3752	rundll32.exe
Token: SeTcbPrivilege	3752	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 3752	4448	rundll32.exe	88
PID 4448 wrote to memory of 3752	4448	rundll32.exe	88
PID 4448 wrote to memory of 3752	4448	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\69cd040d27724d27285171085f96ba7d534a888f4710a36834cd2b2032631d17.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\69cd040d27724d27285171085f96ba7d534a888f4710a36834cd2b2032631d17.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3752