87ea69570136c63736d95fd3950e11c67fd37ab1053410bc9e4aca66805a4cd9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 23:12

Target

XInput9_1_0.dll
Size

11KB
MD5

c5fe86cc2025ea38f5b4a584d99d6c4f
SHA1

eb6135c4751761ccafaee78e884207686eccd94d
SHA256

9018ab4c056298b1fe30103b13f1d762c7048e83d1730893dcbf2294bbb73269
SHA512

58294c13e04a8c3956e0bdd97a0f087dcf4b12be3a7970b5b1837a8dc760e0719c8774cd88c6ecaac74a7dda6177fa3a8653ab7505c38fa396905e4aaeabb559
SSDEEP

192:XQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOymaCwmPgbDLTGc:j/SspI2WgHJZlj/ma/tvi

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 3712 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	3712	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1228 wrote to memory of 1560	1228	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 1560	1228	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 1560	1228	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
2⤵
PID:1560

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3712

memory/3712-0-0x000001C1CFA40000-0x000001C1CFA50000-memory.dmp

Filesize
64KB

Download
memory/3712-16-0x000001C1CFB40000-0x000001C1CFB50000-memory.dmp

Filesize
64KB

Download
memory/3712-32-0x000001C1D7E60000-0x000001C1D7E61000-memory.dmp

Filesize
4KB

Download
memory/3712-34-0x000001C1D7E90000-0x000001C1D7E91000-memory.dmp

Filesize
4KB

Download
memory/3712-35-0x000001C1D7E90000-0x000001C1D7E91000-memory.dmp

Filesize
4KB

Download
memory/3712-36-0x000001C1D7FA0000-0x000001C1D7FA1000-memory.dmp

Filesize
4KB

Download