cf6ba1034aba2177c328f7aaeb15206e8b495a1e63f6da5f3e11f4c4b60d1fd0

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 23:35

Target

cf6ba1034aba2177c328f7aaeb15206e8b495a1e63f6da5f3e11f4c4b60d1fd0.dll
Size

51KB
MD5

f4be7623d785b6389b877b2ac29e5d3a
SHA1

439230ed53ec2bb93afac2dd7f378ae60f51648d
SHA256

cf6ba1034aba2177c328f7aaeb15206e8b495a1e63f6da5f3e11f4c4b60d1fd0
SHA512

1e48717217be2cd1f216dc71c21c165d8603d7f39e5d55a87c49331c4b5cb61c5d532c05b088c30075c1dcf806c0c82b25ba17c04ee31b54053fe16eacaa2fb5
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL2JYH5:1dWubF3n9S91BF3fboSJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4212	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3880	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4212	4084	rundll32.exe	89
PID 4084 wrote to memory of 4212	4084	rundll32.exe	89
PID 4084 wrote to memory of 4212	4084	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf6ba1034aba2177c328f7aaeb15206e8b495a1e63f6da5f3e11f4c4b60d1fd0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf6ba1034aba2177c328f7aaeb15206e8b495a1e63f6da5f3e11f4c4b60d1fd0.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4212

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3880

memory/3880-0-0x0000026E740A0000-0x0000026E740B0000-memory.dmp

Filesize
64KB

Download
memory/3880-16-0x0000026E741A0000-0x0000026E741B0000-memory.dmp

Filesize
64KB

Download
memory/3880-32-0x0000026E7C510000-0x0000026E7C511000-memory.dmp

Filesize
4KB

Download
memory/3880-34-0x0000026E7C540000-0x0000026E7C541000-memory.dmp

Filesize
4KB

Download
memory/3880-35-0x0000026E7C540000-0x0000026E7C541000-memory.dmp

Filesize
4KB

Download
memory/3880-36-0x0000026E7C650000-0x0000026E7C651000-memory.dmp

Filesize
4KB

Download