87ea69570136c63736d95fd3950e11c67fd37ab1053410bc9e4aca66805a4cd9

Analysis

max time kernel
1383s
max time network
1171s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2024 06:40

Target

Geode.dll
Size

6.8MB
MD5

7502d8873ce70ddd59e348c29183ed85
SHA1

ac5df33b02c299b3880e4d71cde8f5b21361c3a7
SHA256

67ba23a77ab8cdbb240775185394263e2a0c4b0fe88d9dad9f3837ca6c382c39
SHA512

dd18cc1bd423c73dffbff8126c3a1b24bc882ac9b34fa275128a9ba4fecb22014efbe6c0998268b638bd0ed3928377faef426bce25815042d37659318e6091bc
SSDEEP

49152:K+RiFPY39QoGR/HUYD+eXoKWwvlKg5RYfqBrSQ0FXrs8VOW:vR3NGR/0GX3vlKfql0Vrs8

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 1008 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	1008	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4192 wrote to memory of 4288	4192	rundll32.exe	rundll32.exe
PID 4192 wrote to memory of 4288	4192	rundll32.exe	rundll32.exe
PID 4192 wrote to memory of 4288	4192	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4192

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
2⤵
PID:4288

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1008

memory/1008-0-0x0000022AC6B70000-0x0000022AC6B80000-memory.dmp

Filesize
64KB

Download
memory/1008-16-0x0000022AC6C70000-0x0000022AC6C80000-memory.dmp

Filesize
64KB

Download
memory/1008-32-0x0000022ACEFE0000-0x0000022ACEFE1000-memory.dmp

Filesize
4KB

Download
memory/1008-34-0x0000022ACF010000-0x0000022ACF011000-memory.dmp

Filesize
4KB

Download
memory/1008-35-0x0000022ACF010000-0x0000022ACF011000-memory.dmp

Filesize
4KB

Download
memory/1008-36-0x0000022ACF120000-0x0000022ACF121000-memory.dmp

Filesize
4KB

Download