992112263b3e71207598f8dba1db834fefc03e86c3c837454404e0510ba0cec3

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 07:24

Target

e11bb69a593d0bc9b4fbda7871db0dd1.dll
Size

11KB
MD5

e11bb69a593d0bc9b4fbda7871db0dd1
SHA1

37df4cc8c585bb94ce41d54bc15e5e563a85400c
SHA256

992112263b3e71207598f8dba1db834fefc03e86c3c837454404e0510ba0cec3
SHA512

4ff8e3dfe0b6bbedfc13b4a2f3201d3f8b6202e7f1e8852dcc9b15c5c2a430ee6c582ae6cb2998b171fb028809e4f6d315a70cf9a71e039ff5bd84c68468b1cc
SSDEEP

192:yWP1tanhX+aZBwo8/lgBoxcKpqPXEOC4az0srU8jvTqT4lbEa7GDg38GDC0kgUwQ:yGe5v9wlJK2aXxlaz0B8jvTqTgbb7DwR

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
640	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 3564	4360	rundll32.exe	84
PID 4360 wrote to memory of 3564	4360	rundll32.exe	84
PID 4360 wrote to memory of 3564	4360	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e11bb69a593d0bc9b4fbda7871db0dd1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e11bb69a593d0bc9b4fbda7871db0dd1.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3564

memory/3564-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download