25c7048372bd1c70499320e7d6b2eb5c308bf59567ca8a5bb64f2c5e11069cc8

Analysis

max time kernel
135s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 11:03

Target

c876e0fb0983e772250934d0b9c4ba51.dll
Size

30KB
MD5

c876e0fb0983e772250934d0b9c4ba51
SHA1

ee9f73cdea5540e6348a37904a551e2cc0a1316b
SHA256

25c7048372bd1c70499320e7d6b2eb5c308bf59567ca8a5bb64f2c5e11069cc8
SHA512

4dbbfd2683edcec3215288f6876bb1dc5b7d96980d356f5dc823d69a3eb1d51e43d9a1d6eeb5840dce4ad8c7f14b402f78a6ef44e69d1e22f0060bb75137bb96
SSDEEP

384:FCNe0cVyphNFfRMkQAuER7cx3hYPMyM2JcMGCSuZ658WIH8wfCoqX:qehyp7P158hYPWSvGC1bWw8wKoS

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	5112	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1836	4864	regsvr32.exe	89
PID 4864 wrote to memory of 1836	4864	regsvr32.exe	89
PID 4864 wrote to memory of 1836	4864	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c876e0fb0983e772250934d0b9c4ba51.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c876e0fb0983e772250934d0b9c4ba51.dll
  2⤵
  PID:1836

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5112

memory/5112-0-0x000001FEE9540000-0x000001FEE9550000-memory.dmp

Filesize
64KB

Download
memory/5112-16-0x000001FEE9640000-0x000001FEE9650000-memory.dmp

Filesize
64KB

Download
memory/5112-32-0x000001FEF1960000-0x000001FEF1961000-memory.dmp

Filesize
4KB

Download
memory/5112-34-0x000001FEF1990000-0x000001FEF1991000-memory.dmp

Filesize
4KB

Download
memory/5112-35-0x000001FEF1990000-0x000001FEF1991000-memory.dmp

Filesize
4KB

Download
memory/5112-36-0x000001FEF1AA0000-0x000001FEF1AA1000-memory.dmp

Filesize
4KB

Download