f67cf8615c3b1540b7ac51d078d526627be58773cd25b6fc6b1cc6b30390323c

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 20:14

Target

f67cf8615c3b1540b7ac51d078d526627be58773cd25b6fc6b1cc6b30390323c.dll
Size

397KB
MD5

7f1cbc650e90e3d164ed00121031bd16
SHA1

c4b9f95231141f251cf7519329d643c13e622a2e
SHA256

f67cf8615c3b1540b7ac51d078d526627be58773cd25b6fc6b1cc6b30390323c
SHA512

4b8efcb16b88f32c375006f538e8a77f026d2a0f645acfbc4af9ee65a8227b4eb6120ecfd908345085b0f06be7d288ed06ee9a72bd787c7b5829816be79c6529
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOai:174g2LDeiPDImOkx2LIai

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	320	rundll32.exe
Token: SeTcbPrivilege	320	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 320	4216	rundll32.exe	88
PID 4216 wrote to memory of 320	4216	rundll32.exe	88
PID 4216 wrote to memory of 320	4216	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f67cf8615c3b1540b7ac51d078d526627be58773cd25b6fc6b1cc6b30390323c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f67cf8615c3b1540b7ac51d078d526627be58773cd25b6fc6b1cc6b30390323c.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:320