4d9f9c329200d932ad5a1b30d419aca5a67addd6b1f08740ddac4e8dc32e20f0

Analysis

max time kernel
1744s
max time network
1161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-02-2024 16:28

Target

LANC Remastered (lancremasteredpcps.com)/PsychoCoding Theme.dll
Size

96KB
MD5

bdfd2b195bb55f1054251cb52abb5dad
SHA1

6f93f734f75d7e01852744c68312d8532e60dfe3
SHA256

070583767d41d7913df3c7c791800216edf1329a64917b028d1f24e3a977e498
SHA512

22f1d63fc19a961c994a63eaccb257c5fabdc95f3a7d13c74283b71fd10fd8000718254b8ef163640aecbbc3934d703f72a9d2bd1eb418414678adfc8f6332ca
SSDEEP

1536:+HuaS9WG9fFc50/+FKhz7v+nF+tWitbOoQDsx:euaS9/9fFYKhHQUbOoQG

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 1480 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	1480	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\LANC Remastered (lancremasteredpcps.com)\PsychoCoding Theme.dll",#1
1⤵
PID:1260

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1480

memory/1480-0-0x000001B496140000-0x000001B496150000-memory.dmp

Filesize
64KB

Download
memory/1480-16-0x000001B496240000-0x000001B496250000-memory.dmp

Filesize
64KB

Download
memory/1480-32-0x000001B49E570000-0x000001B49E571000-memory.dmp

Filesize
4KB

Download
memory/1480-34-0x000001B49E590000-0x000001B49E591000-memory.dmp

Filesize
4KB

Download
memory/1480-35-0x000001B49E590000-0x000001B49E591000-memory.dmp

Filesize
4KB

Download
memory/1480-36-0x000001B49E5A0000-0x000001B49E5A1000-memory.dmp

Filesize
4KB

Download