c337776a985a2e6a604ea07935c7f3331976b175d52c54b37dc80d90e9475474

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 12:06

Target

c337776a985a2e6a604ea07935c7f3331976b175d52c54b37dc80d90e9475474.dll
Size

397KB
MD5

8eed482275b678610f9be2f36cb0f496
SHA1

d93092d56e14e92944080b321b40e123fcd7f30f
SHA256

c337776a985a2e6a604ea07935c7f3331976b175d52c54b37dc80d90e9475474
SHA512

45132c946fc9bd8a32eed7d7cc49acfaab7ac652534f87844f26b05a3c1a63a016f883c59b3cd678fa692b824b9f422c33249c3d4f5a587b2173db2828499dfe
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa0:174g2LDeiPDImOkx2LIa0

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	rundll32.exe
Token: SeTcbPrivilege	4540	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 4540	3312	rundll32.exe	70
PID 3312 wrote to memory of 4540	3312	rundll32.exe	70
PID 3312 wrote to memory of 4540	3312	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c337776a985a2e6a604ea07935c7f3331976b175d52c54b37dc80d90e9475474.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c337776a985a2e6a604ea07935c7f3331976b175d52c54b37dc80d90e9475474.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4540