0ceaee9f8d0b20c106631480f7d4b8c44227c970bd2d6a39eb0ef93433869655

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 14:58

Target

0ceaee9f8d0b20c106631480f7d4b8c44227c970bd2d6a39eb0ef93433869655.dll
Size

397KB
MD5

91b5b514993895f7aa68e68caea991d0
SHA1

a0e60f5e4beec5a18aaa733b2d26f75d0098f36c
SHA256

0ceaee9f8d0b20c106631480f7d4b8c44227c970bd2d6a39eb0ef93433869655
SHA512

b824610812194acfdbdfe24badaae01f29270facc07dbb5076544052791202c79b2722c2eaa8f01eefce8c97084b6bcc992adaeffcf39f346b7b6af9ace9c5ac
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa7:174g2LDeiPDImOkx2LIa7

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	rundll32.exe
Token: SeTcbPrivilege	2732	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2732	5072	rundll32.exe	84
PID 5072 wrote to memory of 2732	5072	rundll32.exe	84
PID 5072 wrote to memory of 2732	5072	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ceaee9f8d0b20c106631480f7d4b8c44227c970bd2d6a39eb0ef93433869655.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ceaee9f8d0b20c106631480f7d4b8c44227c970bd2d6a39eb0ef93433869655.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2732