dbcea5341a1a3010d6e8f51205a301f6bbf85104f70d6045bec51439524a4e74

Analysis

max time kernel
139s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 13:25

Target

7a5e9f2d19d3f2865eecfb3c5c52232f.dll
Size

40KB
MD5

7a5e9f2d19d3f2865eecfb3c5c52232f
SHA1

c40a5eebfe9823faa74cbf6b1bb43f96b974c1f4
SHA256

dbcea5341a1a3010d6e8f51205a301f6bbf85104f70d6045bec51439524a4e74
SHA512

94c6dfc6dead8b25d365563c58a5c7a86145e8e93482f6c6b34ab10b0595a1124f5ac0be5f1779303685f8b287e373eac68d6cd1d533d3326325efa59db3b482
SSDEEP

384:gsWpbrqlefcrUiWwQuhDWoqPlq1gWfLZsFXQ0PRm1P8Z:gDdqsf0UiWwQuhLqPl6g/QQQ1P

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1864	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 1864	5076	rundll32.exe	85
PID 5076 wrote to memory of 1864	5076	rundll32.exe	85
PID 5076 wrote to memory of 1864	5076	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a5e9f2d19d3f2865eecfb3c5c52232f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a5e9f2d19d3f2865eecfb3c5c52232f.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1864

memory/1864-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download