58d8ba1fb4b5dfd8a67b0901d24ccc7198fbae47a73dbdcb6dcf497dbe2bee50

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 19:19

Target

8ff1e2fe4f18ef9b72a140e8251c0027.dll
Size

21KB
MD5

8ff1e2fe4f18ef9b72a140e8251c0027
SHA1

8f5d7e1891935bd15fd5f5baee6853c29743fb04
SHA256

58d8ba1fb4b5dfd8a67b0901d24ccc7198fbae47a73dbdcb6dcf497dbe2bee50
SHA512

1ab1bc463b1a7f600e92e00e32d3c374acf85844c947e0bc973868e698c53501d5ba2736bf08380fbac0caaacc3891ab3c933368cbf124558b957fbfc2aaafc7
SSDEEP

384:IxSmCiIjMqn2QZRbCocgoJLroDv2JdmCz2/v+fSK5wa46qbs8:IxkiIjMqtZcfjJQmuviSK5w36n

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1776	1440	rundll32.exe	40
PID 1440 wrote to memory of 1776	1440	rundll32.exe	40
PID 1440 wrote to memory of 1776	1440	rundll32.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ff1e2fe4f18ef9b72a140e8251c0027.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ff1e2fe4f18ef9b72a140e8251c0027.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1776