5237619793999da27399eaac337774683cdb9f14b8148339f75191d97ca1014f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 07:19

Target

b6d66167a3d22cfa967a9ba0e2af930e.dll
Size

41KB
MD5

b6d66167a3d22cfa967a9ba0e2af930e
SHA1

df6c71f9145fbed5aba053e3af5ce5b2e571f6c9
SHA256

5237619793999da27399eaac337774683cdb9f14b8148339f75191d97ca1014f
SHA512

73abbddf5d22ca1dd305fd282598132a625b353db692cba768cea8aed0eb7cfe347961b405bc0f0bb7a4f6da56f7f0a5ce6baac88c80dd00e7fcf6b2355a33bc
SSDEEP

768:2Zxj6Z2SNTSt7sz4WuQfyPE3GpH+UZA5K7cjkisGiwM:SxW2SNTShS4WuQBkJZbcewM

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ukrth.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ukrth.dll	rundll32.exe
File created	C:\Windows\SysWOW64\hjmh.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\hjmh.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3464	2808	rundll32.exe	87
PID 2808 wrote to memory of 3464	2808	rundll32.exe	87
PID 2808 wrote to memory of 3464	2808	rundll32.exe	87
PID 3464 wrote to memory of 3536	3464	rundll32.exe	56
PID 3464 wrote to memory of 3536	3464	rundll32.exe	56
PID 3464 wrote to memory of 2080	3464	rundll32.exe	37
PID 3464 wrote to memory of 2080	3464	rundll32.exe	37