2e9ded51fbc9ae6745fbf52b43d84200510b89f1b27f8ee13016b14e8d8d1b71

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 18:21

Target

c148f63c457800fc205cf2b384613ab9.dll
Size

11KB
MD5

c148f63c457800fc205cf2b384613ab9
SHA1

b342bd2dd09c60f7d98a94c4ad0dd5b044fce3ef
SHA256

2e9ded51fbc9ae6745fbf52b43d84200510b89f1b27f8ee13016b14e8d8d1b71
SHA512

b077d9c4c163cefdf8fc6519d3bc04dcd4a0a7ced42b2f8808232fef27b48ab1883d61f81a42c4ef2393a851664501d48fff513d26ca90350014a9b6aeac1e03
SSDEEP

192:PLWh94I0pYhBNhDaHJ6kAyxP11TdUFMrokgVo8F97Bd9IsTteKXRv22kgUw9U0:DqZvaHUkAyJLTAvC8F97BdvpVRv2ZN0

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1856	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1856	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1856	4748	rundll32.exe	85
PID 4748 wrote to memory of 1856	4748	rundll32.exe	85
PID 4748 wrote to memory of 1856	4748	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c148f63c457800fc205cf2b384613ab9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c148f63c457800fc205cf2b384613ab9.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1856

memory/1856-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download