8f5b8114ae4a4eedbc0a8c757f91cfb7eb953b67677bbfeef03c9c4ef46f6926

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2024 11:41

Target

8f5b8114ae4a4eedbc0a8c757f91cfb7eb953b67677bbfeef03c9c4ef46f6926.dll
Size

397KB
MD5

fa39bd131a3adecb5e00ac396ad5688b
SHA1

be26df349649db53081fbf1cb4aa23467f280345
SHA256

8f5b8114ae4a4eedbc0a8c757f91cfb7eb953b67677bbfeef03c9c4ef46f6926
SHA512

2e9eccc25458f1b940d0538da1ccf6d25d033c1143fb46f4f63a6837b6a7edfbc30914be1f2c6451c83954cb258aaf2f4b7a3a35d15987aa36eb6e2eb0e8c081
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa0:174g2LDeiPDImOkx2LIa0

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	rundll32.exe
Token: SeTcbPrivilege	3192	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 3192	1400	rundll32.exe	12
PID 1400 wrote to memory of 3192	1400	rundll32.exe	12
PID 1400 wrote to memory of 3192	1400	rundll32.exe	12

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f5b8114ae4a4eedbc0a8c757f91cfb7eb953b67677bbfeef03c9c4ef46f6926.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400