6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2024 22:04

Target

6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab.dll
Size

72KB
MD5

dd6257665f634b5566e15bc62e90c809
SHA1

54ded03f7b82c8aa4de10e673b556d0ba778177d
SHA256

6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab
SHA512

60e6297803141206a2ef9c30c028fb87581205623774e4c43ef4566dd42b61faf8d85fb3ddca2ec516448500dd392c01bdfb781c1bacd38b6c0a04837237eb85
SSDEEP

1536:CZYCKkPkDwBycMjIBbzreg/+UgOiALGr05:CZYCKkPkc7bHpdpin05

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1088	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 2248	4404	rundll32.exe	90
PID 4404 wrote to memory of 2248	4404	rundll32.exe	90
PID 4404 wrote to memory of 2248	4404	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab.dll,#1
  2⤵
  PID:2248

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088

memory/1088-0-0x000002B2FFA40000-0x000002B2FFA50000-memory.dmp

Filesize
64KB

Download
memory/1088-16-0x000002B2FFB40000-0x000002B2FFB50000-memory.dmp

Filesize
64KB

Download
memory/1088-34-0x000002B2FFE80000-0x000002B2FFE81000-memory.dmp

Filesize
4KB

Download
memory/1088-36-0x000002B2FFF90000-0x000002B2FFF91000-memory.dmp

Filesize
4KB

Download
memory/1088-35-0x000002B2FFE80000-0x000002B2FFE81000-memory.dmp

Filesize
4KB

Download
memory/1088-32-0x000002B2FFE50000-0x000002B2FFE51000-memory.dmp

Filesize
4KB

Download