942b6b135f4f4d23a4b52e7c7a4e9f91808a3ff607e49e3ea349bb784d155375

Analysis

max time kernel
154s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 03:30

Target

ca5edc4420a02fc0b69c4beeb0ebc761.dll
Size

11KB
MD5

ca5edc4420a02fc0b69c4beeb0ebc761
SHA1

3a81961e8e2d2fe7cf1d8812a2e792b2e91ed0fa
SHA256

942b6b135f4f4d23a4b52e7c7a4e9f91808a3ff607e49e3ea349bb784d155375
SHA512

50f5567c0424e4627fa85836c8b86c3f33cf66ba3a068b2e0a39c9fee0673a3cb1a05783602e97bd15aa2b60c5c80ba587c4600ad71085752c0a1dde1a7214e5
SSDEEP

192:ax/xvECpOArhUgooqHEm4EkajcsWq+XTe0p/cpyPToMD6snsAe4yAjkgUw9h:abvtYAVUu4J4EL4sWHa0tcbMD3sAe4yq

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5024	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5024	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5024	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 5024	3032	rundll32.exe	84
PID 3032 wrote to memory of 5024	3032	rundll32.exe	84
PID 3032 wrote to memory of 5024	3032	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca5edc4420a02fc0b69c4beeb0ebc761.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca5edc4420a02fc0b69c4beeb0ebc761.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5024

memory/5024-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download