3f80c20fecafcfa264532eae938edb81dd04c8d0335c366f0b3c4c64ad529967

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 23:27

Target

data/appInfo/services/data/Launcher.dll
Size

6KB
MD5

f58866e5a48d89c883f3932c279004db
SHA1

e72182e9ee4738577b01359f5acbfbbe8daa2b7f
SHA256

d6f3e13dfff0a116190504efbfcbcd68f5d2183e6f89fd4c860360fba0ec8c12
SHA512

7e76555e62281d355c2346177f60bfe2dc433145037a34cfc2f5848509401768b4db3a9fd2f6e1a1d69c5341db6a0b956abf4d975f28ee4262f1443b192fe177
SSDEEP

96:b0bb/xXjs8XNeWeQUjCq61hl+L08Nuz+570phTlA8cP:bC/xXo89eWidohls7wK70vTlPcP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 3692 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	3692	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\appInfo\services\data\Launcher.dll,#1
1⤵
PID:1532

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3692

memory/3692-0-0x000001FD64960000-0x000001FD64970000-memory.dmp

Filesize
64KB

Download
memory/3692-16-0x000001FD64A60000-0x000001FD64A70000-memory.dmp

Filesize
64KB

Download
memory/3692-32-0x000001FD6CDD0000-0x000001FD6CDD1000-memory.dmp

Filesize
4KB

Download
memory/3692-34-0x000001FD6CE00000-0x000001FD6CE01000-memory.dmp

Filesize
4KB

Download
memory/3692-35-0x000001FD6CE00000-0x000001FD6CE01000-memory.dmp

Filesize
4KB

Download
memory/3692-36-0x000001FD6CF10000-0x000001FD6CF11000-memory.dmp

Filesize
4KB

Download