53999599cf01bfc9cc10bfb90219d7ec83c7ba03f6c6e922b08684627f185edf

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 10:49

Target

bb12ad7c2423a31b3053396807a89474.dll
Size

13KB
MD5

bb12ad7c2423a31b3053396807a89474
SHA1

5632c81c8b32d5bcdf1cafdc63d14a84d76b8d4b
SHA256

53999599cf01bfc9cc10bfb90219d7ec83c7ba03f6c6e922b08684627f185edf
SHA512

421a7186864c79990cce0d8965c77f466dddb822ef0c1553ecd33195e4a6ab9719ba9ba7d3d02260a3fb4166384bda9474ce1fae677d7dafeb73018f90c8f1b7
SSDEEP

192:uJhrAbTBLgxTFexspPn6AEOhHl/UdTHfQ1E5NMuiMsZSqN1Q7DBQloPXjQ6xkgUC:uPuBLgxYKpyjYHl/G74m7jsgt7D4yR

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1352	1348	rundll32.exe	89
PID 1348 wrote to memory of 1352	1348	rundll32.exe	89
PID 1348 wrote to memory of 1352	1348	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb12ad7c2423a31b3053396807a89474.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb12ad7c2423a31b3053396807a89474.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1352

memory/1352-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download