a829e33c5e4db2ea90f23d2eadca782d318d53f2fcd6cb2d4d804af9255d76ba

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2024 13:12

Target

a829e33c5e4db2ea90f23d2eadca782d318d53f2fcd6cb2d4d804af9255d76ba.dll
Size

397KB
MD5

a5ea13f45f50990ba4d8e88cea233d96
SHA1

1244482747721a88e764cffd320df8fac0425a65
SHA256

a829e33c5e4db2ea90f23d2eadca782d318d53f2fcd6cb2d4d804af9255d76ba
SHA512

07cf0ee4eed0833672c48f14fd6888928787b00b6d2648a363e679557e828a942c3db54f553069192d601caf717d2ef05e860342d57de5d6f339cec546a7496e
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOav:174g2LDeiPDImOkx2LIav

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3172	rundll32.exe
Token: SeTcbPrivilege	3172	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 3172	3620	rundll32.exe	86
PID 3620 wrote to memory of 3172	3620	rundll32.exe	86
PID 3620 wrote to memory of 3172	3620	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a829e33c5e4db2ea90f23d2eadca782d318d53f2fcd6cb2d4d804af9255d76ba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a829e33c5e4db2ea90f23d2eadca782d318d53f2fcd6cb2d4d804af9255d76ba.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3172