09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2024 17:28

Target

09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0.dll
Size

185KB
MD5

e15fc1136589422437e1cbb4c58abf13
SHA1

3f9ac7f863297eb300c5cc9224bfbfb9071ae13d
SHA256

09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0
SHA512

e66615c9af558fe27cfadf27af23a09b3c1b31866e98c442dc48a6f4fed72400da3731b6353d477d64e587d63129c95de37d23d0dbdcdb4b4866f57805e6578a
SSDEEP

3072:Pui8BeS3MmdOwH6Yq8xWd84HQ5ijAELS9JkCXrq2dMKCurrXnYc6:Pui8Bp1Owrq8084HJAELyWCrLYx

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	220	rundll32.exe
Token: SeTcbPrivilege	220	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 220	4304	rundll32.exe	94
PID 4304 wrote to memory of 220	4304	rundll32.exe	94
PID 4304 wrote to memory of 220	4304	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:3672