ed186b62d2028ac3aeb65cedaa4dc9f5b001fec3f96ff4de0ae4590ed2a60b06

Analysis

max time kernel
146s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 22:01

Target

ed186b62d2028ac3aeb65cedaa4dc9f5b001fec3f96ff4de0ae4590ed2a60b06.dll
Size

899KB
MD5

1217cad12f8921ad72acd46025ede5ad
SHA1

2f28db61abd3fcffe9f3e1213a528661e6230437
SHA256

ed186b62d2028ac3aeb65cedaa4dc9f5b001fec3f96ff4de0ae4590ed2a60b06
SHA512

f482aaaf9964a06031b3ba2d4263b2373f1adb37eab867cc2670a99f058441093451f8c0d98fd1a3c7690e6b2a762f95d4817888631be2594b38b548a937af1c
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXX:7wqd87VX

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3172	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1904	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 3172	1628	rundll32.exe	90
PID 1628 wrote to memory of 3172	1628	rundll32.exe	90
PID 1628 wrote to memory of 3172	1628	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed186b62d2028ac3aeb65cedaa4dc9f5b001fec3f96ff4de0ae4590ed2a60b06.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed186b62d2028ac3aeb65cedaa4dc9f5b001fec3f96ff4de0ae4590ed2a60b06.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3172

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1904

memory/1904-16-0x0000023DF7A60000-0x0000023DF7A70000-memory.dmp

Filesize
64KB

Download
memory/1904-36-0x0000023DFFF10000-0x0000023DFFF11000-memory.dmp

Filesize
4KB

Download
memory/1904-35-0x0000023DFFE00000-0x0000023DFFE01000-memory.dmp

Filesize
4KB

Download
memory/1904-34-0x0000023DFFE00000-0x0000023DFFE01000-memory.dmp

Filesize
4KB

Download
memory/1904-32-0x0000023DFFDD0000-0x0000023DFFDD1000-memory.dmp

Filesize
4KB

Download
memory/1904-0-0x0000023DF7960000-0x0000023DF7970000-memory.dmp

Filesize
64KB

Download