b26f95d90e54870c881384525ff8d9bbe954840be50b01e4d516f3a214089bff

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 10:36

Target

652be4ce3e22143465ce5bd2551e7870.dll
Size

9KB
MD5

652be4ce3e22143465ce5bd2551e7870
SHA1

d52d33dbd98586b92c745a811d0c5b198939ebe0
SHA256

b26f95d90e54870c881384525ff8d9bbe954840be50b01e4d516f3a214089bff
SHA512

f2cabe59f6e1def59841dd40a62688adec4f8eb15b0bc03752011535ac41612e067845f7f8dd4f8078f9e7da44c99695aa2e3f0a090008cb164d999116bebd3b
SSDEEP

192:n+kQBHJiz1fnol6DYPfpqq2/JxpWVGoKkgUw9F:1Mi1foBq5/Jxpl2K

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TesSafe.sys	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3032	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 1016	2672	rundll32.exe	89
PID 2672 wrote to memory of 1016	2672	rundll32.exe	89
PID 2672 wrote to memory of 1016	2672	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\652be4ce3e22143465ce5bd2551e7870.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\652be4ce3e22143465ce5bd2551e7870.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:1016

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032

memory/1016-0-0x0000000025000000-0x0000000025018000-memory.dmp

Filesize
96KB

Download
memory/3032-18-0x000002D60DC40000-0x000002D60DC50000-memory.dmp

Filesize
64KB

Download
memory/3032-2-0x000002D60DB40000-0x000002D60DB50000-memory.dmp

Filesize
64KB

Download
memory/3032-34-0x000002D615F30000-0x000002D615F31000-memory.dmp

Filesize
4KB

Download
memory/3032-38-0x000002D616070000-0x000002D616071000-memory.dmp

Filesize
4KB

Download
memory/3032-37-0x000002D615F60000-0x000002D615F61000-memory.dmp

Filesize
4KB

Download
memory/3032-36-0x000002D615F60000-0x000002D615F61000-memory.dmp

Filesize
4KB

Download