49fdea1c25686d678ae4f7c9ea793eb2596729114917c0862553580e8fc1d546

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2024 05:40

Target

86132df8af8237e52c81fd5ce893d03a.dll
Size

225KB
MD5

86132df8af8237e52c81fd5ce893d03a
SHA1

1d709cee5be0aa9bccc2fdbdd110158e6d0f7f1d
SHA256

49fdea1c25686d678ae4f7c9ea793eb2596729114917c0862553580e8fc1d546
SHA512

804f4c34fdaf1f8c34400c9dd91b87df4342226c124867fde52bb1ce2a36d2402015fb078a8f1d6ca23168693a8131d1e4c3df36de4095fee082ac7cf06e0043
SSDEEP

3072:Ng3fb22+/g6yrVXg/Difch8kSRQy0GpZINo72TentqyT4pSkDVUE36YT+1:S3DMY6yZQo3JuC48N+Kgf

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	rundll32.exe
File opened for modification	C:\Windows\twisys.ini	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1176	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 1176	4900	rundll32.exe	14
PID 4900 wrote to memory of 1176	4900	rundll32.exe	14
PID 4900 wrote to memory of 1176	4900	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86132df8af8237e52c81fd5ce893d03a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\twisys.ini

Filesize
40B

MD5
2f252db48a212a83dc16ee89c0bd95c3

SHA1
a4dfdf31b25da5816abfc95f3187cacee791507f

SHA256
501698dc94fa70b9ba9368170b2ebcdcc1263d7b5ebe639b4556cadc3516f460

SHA512
0ebec3d15da6866e2987af09cef76ae880a80509b4b5c778fa6ffc054036e8cbb883151c76c8dfb90960a72a67c0dc3da82ee71c22888be2a9b981ef4048fd25

Download Submit