a6dfba77ffe9c4a972a96f1123a8c6a9269d40f31360032b8cd12165baf83f51

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 12:40

Target

a6dfba77ffe9c4a972a96f1123a8c6a9269d40f31360032b8cd12165baf83f51.dll
Size

397KB
MD5

42078dfd510425f38410dece5f97c193
SHA1

8c0251e22d693857e9887c27f2d101e3468cbd80
SHA256

a6dfba77ffe9c4a972a96f1123a8c6a9269d40f31360032b8cd12165baf83f51
SHA512

74533bb0f977abd37a5afee389be793cfba4bf0655a8c70e636d757679e3fa43f98680ab5590478c665d7ea937f948015dac807940f8c7e6f91346655ceebb56
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaq:174g2LDeiPDImOkx2LIaq

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	rundll32.exe
Token: SeTcbPrivilege	872	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 872	3188	rundll32.exe	37
PID 3188 wrote to memory of 872	3188	rundll32.exe	37
PID 3188 wrote to memory of 872	3188	rundll32.exe	37

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6dfba77ffe9c4a972a96f1123a8c6a9269d40f31360032b8cd12165baf83f51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6dfba77ffe9c4a972a96f1123a8c6a9269d40f31360032b8cd12165baf83f51.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:872