3deb76a0e87070d8a0d031080942fdb78416bdd8573c562c4f5d75921fbbc11a

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 13:10

Target

3deb76a0e87070d8a0d031080942fdb78416bdd8573c562c4f5d75921fbbc11a.dll
Size

397KB
MD5

2dfecfa6787f7b3aa68603950829d576
SHA1

c837e60a6dd9c859a83e1251c89afb8ecfcf15bc
SHA256

3deb76a0e87070d8a0d031080942fdb78416bdd8573c562c4f5d75921fbbc11a
SHA512

51695a82d284345eeafb402beb39183d54601993119fc7d2e6857cfbd6c3469707cc31a3ed7adf81fc7fd03da8e5327590d6653bc20b759daebf968b54e314c9
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaz:174g2LDeiPDImOkx2LIaz

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	rundll32.exe
Token: SeTcbPrivilege	4948	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 4948	2060	rundll32.exe	86
PID 2060 wrote to memory of 4948	2060	rundll32.exe	86
PID 2060 wrote to memory of 4948	2060	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3deb76a0e87070d8a0d031080942fdb78416bdd8573c562c4f5d75921fbbc11a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3deb76a0e87070d8a0d031080942fdb78416bdd8573c562c4f5d75921fbbc11a.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4948