b86fe282bc5699fa400d8eee7ce18ed42068799457c568d23f2d0b0b19dccb9b

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 18:17

Target

5b857caf1fe458e36c541457df2a9ec5.dll
Size

2.0MB
MD5

5b857caf1fe458e36c541457df2a9ec5
SHA1

fc1ba6cacc55d2344f83cf536feaf5fc8c5b255b
SHA256

b86fe282bc5699fa400d8eee7ce18ed42068799457c568d23f2d0b0b19dccb9b
SHA512

0350ff3db147f2450c985c062e786fdc9998fda48b3e2ed0ce98b2fe05373d30b266f2804735fadcd7debc23ea06f34d0e79369f0e4fb20edcf109712a491a3a
SSDEEP

49152:mB1ayn94SdsUJ1gr/AbUmke3PK4lx9ePJ2i9:mB1fs81k/A4oTl+B2i9

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3792	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2552	1492	rundll32.exe	87
PID 1492 wrote to memory of 2552	1492	rundll32.exe	87
PID 1492 wrote to memory of 2552	1492	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b857caf1fe458e36c541457df2a9ec5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b857caf1fe458e36c541457df2a9ec5.dll,#1
  2⤵
  PID:2552

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3792

memory/2552-0-0x0000000002070000-0x0000000002939000-memory.dmp

Filesize
8.8MB

Download
memory/2552-1-0x0000000002070000-0x0000000002939000-memory.dmp

Filesize
8.8MB

Download
memory/2552-2-0x0000000002070000-0x00000000021B1000-memory.dmp

Filesize
1.3MB

Download
memory/3792-3-0x000001D564640000-0x000001D564650000-memory.dmp

Filesize
64KB

Download
memory/3792-19-0x000001D564740000-0x000001D564750000-memory.dmp

Filesize
64KB

Download
memory/3792-35-0x000001D56CA40000-0x000001D56CA41000-memory.dmp

Filesize
4KB

Download
memory/3792-37-0x000001D56CA70000-0x000001D56CA71000-memory.dmp

Filesize
4KB

Download
memory/3792-39-0x000001D56CB80000-0x000001D56CB81000-memory.dmp

Filesize
4KB

Download
memory/3792-38-0x000001D56CA70000-0x000001D56CA71000-memory.dmp

Filesize
4KB

Download