df241ce41007392d47172b33b030c3fa962f7478322c305b8123aba75435a7e7

Analysis

max time kernel
92s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 12:55

Target

df241ce41007392d47172b33b030c3fa962f7478322c305b8123aba75435a7e7.dll
Size

397KB
MD5

733d32873f18c96dfb86fcf7b9edf1b7
SHA1

14816d26577d65c2f5b49fc6726e82bb2dea8c72
SHA256

df241ce41007392d47172b33b030c3fa962f7478322c305b8123aba75435a7e7
SHA512

284e47e05c41d15e6520e413d5f3463ebb21860e093ee39454c07cbbe5a52baa06b5aef6c6f54b11baed7b4dff3daecb87c5b2bed5625cd0f0694d4bd61bf307
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOav:174g2LDeiPDImOkx2LIav

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4172	rundll32.exe
Token: SeTcbPrivilege	4172	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 4172	2456	rundll32.exe	84
PID 2456 wrote to memory of 4172	2456	rundll32.exe	84
PID 2456 wrote to memory of 4172	2456	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df241ce41007392d47172b33b030c3fa962f7478322c305b8123aba75435a7e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\df241ce41007392d47172b33b030c3fa962f7478322c305b8123aba75435a7e7.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4172