337483f726f3b82de728328f5d3d6eb1622730cd42ea9fc617964886cb425b75

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 16:41

Target

681fa13b9f1bc4734cf287ef87596beb.dll
Size

85KB
MD5

681fa13b9f1bc4734cf287ef87596beb
SHA1

8ec7c6a2b70883b5be85e6b8b3ff8c0f6574ad63
SHA256

337483f726f3b82de728328f5d3d6eb1622730cd42ea9fc617964886cb425b75
SHA512

4cea2741354007e05f374faf90652ea4c67e2e77ce03e4b16de8623e6f072df088ed01a906c20f977be5ee0cbe84c343226b118f308923e367b5fb93f2f77c1e
SSDEEP

1536:t5Zd1CG33MD2mmg29+2Oa0OYziAha31N2cqHk5LVxxqpQjYw44A7wcRAP5i7Di1S:93Bn/R9+jYY7+wHmxxQMYw44AscRs293

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1032	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5088	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 5088	3732	rundll32.exe	76
PID 3732 wrote to memory of 5088	3732	rundll32.exe	76
PID 3732 wrote to memory of 5088	3732	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\681fa13b9f1bc4734cf287ef87596beb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\681fa13b9f1bc4734cf287ef87596beb.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5088

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1032

memory/1032-29-0x000001E960740000-0x000001E960750000-memory.dmp

Filesize
64KB

Download
memory/1032-49-0x000001E968BA0000-0x000001E968BA1000-memory.dmp

Filesize
4KB

Download
memory/1032-48-0x000001E968A90000-0x000001E968A91000-memory.dmp

Filesize
4KB

Download
memory/1032-47-0x000001E968A90000-0x000001E968A91000-memory.dmp

Filesize
4KB

Download
memory/1032-45-0x000001E968A60000-0x000001E968A61000-memory.dmp

Filesize
4KB

Download
memory/1032-13-0x000001E960640000-0x000001E960650000-memory.dmp

Filesize
64KB

Download
memory/5088-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/5088-1-0x0000000000D70000-0x0000000000D7F000-memory.dmp

Filesize
60KB

Download
memory/5088-2-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/5088-3-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download