7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 15:07

Target

7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878.dll
Size

397KB
MD5

cb5fe606c0684da3911d73a96b95925b
SHA1

cb495ac76819503008c93c6536f0819ccf10a30c
SHA256

7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878
SHA512

0f7c2d60c429676dcf6db7ddcb7ed17ade0aa229494118de921d67f6b772bcfe3390b66af80abf7ea476a603093ce74d8e1ae72dbc093d002d6e8de4d7873219
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaN:174g2LDeiPDImOkx2LIaN

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	rundll32.exe
Token: SeTcbPrivilege	4548	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 4548	2728	rundll32.exe	83
PID 2728 wrote to memory of 4548	2728	rundll32.exe	83
PID 2728 wrote to memory of 4548	2728	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4548