a939a7442be3ed8abe6ae09b8531fe38e7b871f256301d1b5a742562e39f28ac

Analysis

max time kernel
88s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 12:58

Target

a939a7442be3ed8abe6ae09b8531fe38e7b871f256301d1b5a742562e39f28ac.dll
Size

397KB
MD5

3d5cd0a1222aa30fc4d4ac62a959794d
SHA1

63292b0cfe6da2c5684dc7224493eba5b28ddad0
SHA256

a939a7442be3ed8abe6ae09b8531fe38e7b871f256301d1b5a742562e39f28ac
SHA512

68e885f35412a6cb77f73a362dc441c93dfd0422f9b60e9bdf9be3d555047eac571c10660b9afab1870ff8700eba826899188dc958aad9b0f879664c38874a9a
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaq:174g2LDeiPDImOkx2LIaq

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	820	rundll32.exe
Token: SeTcbPrivilege	820	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 820	1364	rundll32.exe	86
PID 1364 wrote to memory of 820	1364	rundll32.exe	86
PID 1364 wrote to memory of 820	1364	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a939a7442be3ed8abe6ae09b8531fe38e7b871f256301d1b5a742562e39f28ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a939a7442be3ed8abe6ae09b8531fe38e7b871f256301d1b5a742562e39f28ac.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:820