5ca571e31a9a247aae0e0c029d89206ef8582520ea12deeb321d2fb57b7a23b8

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 23:40

Target

5ca571e31a9a247aae0e0c029d89206ef8582520ea12deeb321d2fb57b7a23b8.dll
Size

51KB
MD5

1fc38bd75405451a88b6cd0e2f701761
SHA1

b16a9535a294c1c9114e1d476d4bf0ed7db84f58
SHA256

5ca571e31a9a247aae0e0c029d89206ef8582520ea12deeb321d2fb57b7a23b8
SHA512

b99c3e979cb9a7ae753d96f9537a6853db22162b646e795bd806c198c01214464fd2d99c2a8f109965c522cc7bec99433ae9268895afe217ca402af0f14ada63
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+zJYH5:1dWubF3n9S91BF3fbooJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2040	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3064	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2040	1680	rundll32.exe	69
PID 1680 wrote to memory of 2040	1680	rundll32.exe	69
PID 1680 wrote to memory of 2040	1680	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ca571e31a9a247aae0e0c029d89206ef8582520ea12deeb321d2fb57b7a23b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ca571e31a9a247aae0e0c029d89206ef8582520ea12deeb321d2fb57b7a23b8.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2040

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3064

memory/3064-0-0x0000029DE5240000-0x0000029DE5250000-memory.dmp

Filesize
64KB

Download
memory/3064-16-0x0000029DE5340000-0x0000029DE5350000-memory.dmp

Filesize
64KB

Download
memory/3064-32-0x0000029DED6B0000-0x0000029DED6B1000-memory.dmp

Filesize
4KB

Download
memory/3064-34-0x0000029DED6E0000-0x0000029DED6E1000-memory.dmp

Filesize
4KB

Download
memory/3064-35-0x0000029DED6E0000-0x0000029DED6E1000-memory.dmp

Filesize
4KB

Download
memory/3064-36-0x0000029DED7F0000-0x0000029DED7F1000-memory.dmp

Filesize
4KB

Download