b8226b12ac7c707a3598a498602c761239008c17213ef04bf7675f2b95fcfd68

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 12:42

Target

b8226b12ac7c707a3598a498602c761239008c17213ef04bf7675f2b95fcfd68.dll
Size

397KB
MD5

2782a6900d352c9936f095d4fea8c8d2
SHA1

30acc432bb4077f37dead336ab9e7f491260f39f
SHA256

b8226b12ac7c707a3598a498602c761239008c17213ef04bf7675f2b95fcfd68
SHA512

0706bbdcf6007d81561a8362fa89d4740548f6f03ab02cb02c79175b010dc6e87d4c7aacad88f4df1fb1e3583aba822ae0008d3b0c84f9c2c5ddb4fa068859b6
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa3:174g2LDeiPDImOkx2LIa3

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	rundll32.exe
Token: SeTcbPrivilege	1848	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 1848	4984	rundll32.exe	88
PID 4984 wrote to memory of 1848	4984	rundll32.exe	88
PID 4984 wrote to memory of 1848	4984	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8226b12ac7c707a3598a498602c761239008c17213ef04bf7675f2b95fcfd68.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8226b12ac7c707a3598a498602c761239008c17213ef04bf7675f2b95fcfd68.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1848