b74f6e951671005dda836839ae6ba514e018602db68463c94be44acdf9d9a560

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 05:47

Target

5c4a3ecf3ffb9046e3b0de5129a4301b.dll
Size

10KB
MD5

5c4a3ecf3ffb9046e3b0de5129a4301b
SHA1

655fda593640f76a71231d5a8c3ca08160ea5f26
SHA256

b74f6e951671005dda836839ae6ba514e018602db68463c94be44acdf9d9a560
SHA512

b8b992a5d1bb3cf3abeeb50056b31086aee2aa9179102b7fecca6b38ebb1ae5e532a4ac078ad8cc26aa2c1383903c62faae9e4388304d1ba2da7065baa9ceb88
SSDEEP

192:HmKR9mC2IsTs4l6t3RRt1WWkSQtpfKdALjwMKy:G29P2I9eYPiyQtqAPwZ

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4616	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3976	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 3976	2136	rundll32.exe	54
PID 2136 wrote to memory of 3976	2136	rundll32.exe	54
PID 2136 wrote to memory of 3976	2136	rundll32.exe	54

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c4a3ecf3ffb9046e3b0de5129a4301b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c4a3ecf3ffb9046e3b0de5129a4301b.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3976

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4616

memory/4616-0-0x000001E66FE40000-0x000001E66FE50000-memory.dmp

Filesize
64KB

Download
memory/4616-16-0x000001E66FF40000-0x000001E66FF50000-memory.dmp

Filesize
64KB

Download
memory/4616-32-0x000001E678260000-0x000001E678261000-memory.dmp

Filesize
4KB

Download
memory/4616-34-0x000001E678290000-0x000001E678291000-memory.dmp

Filesize
4KB

Download
memory/4616-35-0x000001E678290000-0x000001E678291000-memory.dmp

Filesize
4KB

Download
memory/4616-36-0x000001E6783A0000-0x000001E6783A1000-memory.dmp

Filesize
4KB

Download