91977bdb744abb413fb859a0aa3caa9e00785ea6615163cd8b9939c8f38ac4fe

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 00:47

Target

5bb0398df54ca07070f4011c8ac0e844.dll
Size

12KB
MD5

5bb0398df54ca07070f4011c8ac0e844
SHA1

5b12afd94e353957edf7728181d6e0b3a946b1dc
SHA256

91977bdb744abb413fb859a0aa3caa9e00785ea6615163cd8b9939c8f38ac4fe
SHA512

14d6a004c9caebef488613160acb23d5dcea66338e50dc5695efbbce74c22055179ec861c65a76b41b84319ef5462877e8af9bd7451d0bbc3ab139949e15744b
SSDEEP

192:ISdeZBvi5/maBzcSV67S5Pgi9dXtIOCijbD0HzkLAAkPmSv/Bar9fcNp/3bf2Dg1:7de65/oO6m52OCu3oo1wL2jE

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1776	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1776	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 1776	3260	rundll32.exe	85
PID 3260 wrote to memory of 1776	3260	rundll32.exe	85
PID 3260 wrote to memory of 1776	3260	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bb0398df54ca07070f4011c8ac0e844.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bb0398df54ca07070f4011c8ac0e844.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1776

memory/1776-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download