f1d2ad3452ad317bdc874499bb37b19bbe8e65d42f9066909d0d0e1c35621466

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 12:20

Target

c094c59c4b5fb30530a2d880556602e7.dll
Size

13KB
MD5

c094c59c4b5fb30530a2d880556602e7
SHA1

351ff99d727f53d10b73c9492458a84dc69a8d2f
SHA256

f1d2ad3452ad317bdc874499bb37b19bbe8e65d42f9066909d0d0e1c35621466
SHA512

82c63acb00d6afe668a0f4ffb011be7b41b3c7a1b143a5a6e1c263fae357d80b9931f26ee3c33d8e6933eb083d8925a3096aaaa4bb7681160ee93a09e079b92f
SSDEEP

192:UTXQd0fa8bLpl2Hh6jnE8SUEEKbvnKBGNGYLfdyB9XlPrVOUCgdD6makzG6TcDNu:gO0BltJKbfNLfQHVPrV9DdlYej8C

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4656	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4656	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4656	4468	rundll32.exe	87
PID 4468 wrote to memory of 4656	4468	rundll32.exe	87
PID 4468 wrote to memory of 4656	4468	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c094c59c4b5fb30530a2d880556602e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c094c59c4b5fb30530a2d880556602e7.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4656

memory/4656-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download