ae43ad60d0eb7a6b8f95b6c908479f53fbd55e6238b2ce6e697deffda0db9b91

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-02-2024 19:53

Target

ae43ad60d0eb7a6b8f95b6c908479f53fbd55e6238b2ce6e697deffda0db9b91.dll
Size

397KB
MD5

7805cf53e4f223ae8817589ae14be0b0
SHA1

a503ef85bea54b6c982549a84ecf632e9c91b056
SHA256

ae43ad60d0eb7a6b8f95b6c908479f53fbd55e6238b2ce6e697deffda0db9b91
SHA512

32034ae565a0954a095cc7a7a1c4660fee5755fa22491497bb8c76c31ac446538e5f71a0bdf211a8d73453c958a4d367534ebc78c348543d78b7dbd2464e99d5
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaE:174g2LDeiPDImOkx2LIaE

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3580	rundll32.exe
Token: SeTcbPrivilege	3580	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 3580	3868	rundll32.exe	94
PID 3868 wrote to memory of 3580	3868	rundll32.exe	94
PID 3868 wrote to memory of 3580	3868	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae43ad60d0eb7a6b8f95b6c908479f53fbd55e6238b2ce6e697deffda0db9b91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae43ad60d0eb7a6b8f95b6c908479f53fbd55e6238b2ce6e697deffda0db9b91.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:4032