95b69d022d8cfe64cf23b73acc06c34a6328d348f9cad93de79f7da9b5b88dda

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 06:29

Target

66ee0f8eb0b0f4f5e19d86872a5950f7.dll
Size

300KB
MD5

66ee0f8eb0b0f4f5e19d86872a5950f7
SHA1

af5bc6c5ca81a597b215b6f71b8c0c86b28f1379
SHA256

95b69d022d8cfe64cf23b73acc06c34a6328d348f9cad93de79f7da9b5b88dda
SHA512

10b055cc546f7ed173d411cfa0620ebfb43bb21e2513c25332d74782197c6eca00ce92489215c9684f3a616086ec6d5466de4e703896ef07f0c1c78bab479a7d
SSDEEP

6144:ThbAGn9taURe2H8wUY+nvJCYH/N0CdSIIN4mgORRtb9:TZAGnLaUULG+nvJCYH/N0C84mgORp

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	988	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	988	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1700	2792	rundll32.exe	86
PID 2792 wrote to memory of 1700	2792	rundll32.exe	86
PID 2792 wrote to memory of 1700	2792	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66ee0f8eb0b0f4f5e19d86872a5950f7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66ee0f8eb0b0f4f5e19d86872a5950f7.dll,#1
  2⤵
  PID:1700

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d4 0x4cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:988