c70b1199dd3c6f0053abc135696fde393b6324cc478bb590c5204902fb920e5b

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 18:57

Target

c70b1199dd3c6f0053abc135696fde393b6324cc478bb590c5204902fb920e5b.dll
Size

397KB
MD5

30a85aaa7144fe9da31163209945e3aa
SHA1

728ee204e2135046159b04cc07d762ec5e5ef4d8
SHA256

c70b1199dd3c6f0053abc135696fde393b6324cc478bb590c5204902fb920e5b
SHA512

727da55505605ea5c5e50263a03b9ec66e0d05371b3de49b8247aec2caa2a0e33a3a056a359bd8c0d61e3b275017ced323d549f56dd380e4771d27e3acd060d2
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaX:174g2LDeiPDImOkx2LIaX

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	rundll32.exe
Token: SeTcbPrivilege	4312	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 4312	1056	rundll32.exe	89
PID 1056 wrote to memory of 4312	1056	rundll32.exe	89
PID 1056 wrote to memory of 4312	1056	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c70b1199dd3c6f0053abc135696fde393b6324cc478bb590c5204902fb920e5b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c70b1199dd3c6f0053abc135696fde393b6324cc478bb590c5204902fb920e5b.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4312