e05dd2f01b57d897cf08fe50cfb2e7b44807e118db7da017d50f2a5358f60a5e

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 19:52

Target

e05dd2f01b57d897cf08fe50cfb2e7b44807e118db7da017d50f2a5358f60a5e.dll
Size

397KB
MD5

ff7a044a2e31360333eafe7832725714
SHA1

a626beaa75fdb8a7dc3e943238e133a6cd56411e
SHA256

e05dd2f01b57d897cf08fe50cfb2e7b44807e118db7da017d50f2a5358f60a5e
SHA512

3a660f65eafeea9de8e0b215f739249aacb25cd65f4c000c050b4009ba3feeb4d040cf007834aee335c8df1151149bb2f32f0ba25eea92e920ad34184a7e2c0d
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOac:174g2LDeiPDImOkx2LIac

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	rundll32.exe
Token: SeTcbPrivilege	1464	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1464	2572	rundll32.exe	88
PID 2572 wrote to memory of 1464	2572	rundll32.exe	88
PID 2572 wrote to memory of 1464	2572	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e05dd2f01b57d897cf08fe50cfb2e7b44807e118db7da017d50f2a5358f60a5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e05dd2f01b57d897cf08fe50cfb2e7b44807e118db7da017d50f2a5358f60a5e.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1464