e10e4e255af0ba3293aed0222096b70d627a0a8217f1d3d76c2d6813e3074144

Analysis

max time kernel
1795s
max time network
1804s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 01:23

Target

vk_swiftshader.dll
Size

5.0MB
MD5

c3910a9fed38daf90b54b78ba39d0d40
SHA1

6e702fdea3d2989aadab102a2da6d3005cc135d2
SHA256

4a9ca5adbfdb3fd2cee0be0cef83ad21bfd8239d8ea0f8ef9849b8cf879d2d02
SHA512

65b72e9a209ead1a43344731163f39a3d05952b219c8bcc720d1256cc8adfadf938055a322ea951bf1a40172e12809fd487937a20df0c67d0497f671e1626ba0
SSDEEP

49152:eG7ixZvPbWjIXTFy1RYQZHJvuZBiDTwgvsrt5/PXd0kpmaN+WUf4CvB25zT7RCAt:b7iDPqjvzO1Lhgf49zT7grg4

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	5108	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3468 --field-trial-handle=3044,i,17059189006398306756,4247826696353232857,262144 --variations-seed-version /prefetch:8
1⤵
PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5412 --field-trial-handle=3044,i,17059189006398306756,4247826696353232857,262144 --variations-seed-version /prefetch:8
1⤵
PID:3544

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5108

memory/5108-0-0x0000027C4D5A0000-0x0000027C4D5B0000-memory.dmp

Filesize
64KB

Download
memory/5108-16-0x0000027C4D6A0000-0x0000027C4D6B0000-memory.dmp

Filesize
64KB

Download
memory/5108-32-0x0000027C55A10000-0x0000027C55A11000-memory.dmp

Filesize
4KB

Download
memory/5108-34-0x0000027C55A40000-0x0000027C55A41000-memory.dmp

Filesize
4KB

Download
memory/5108-35-0x0000027C55A40000-0x0000027C55A41000-memory.dmp

Filesize
4KB

Download
memory/5108-36-0x0000027C55B50000-0x0000027C55B51000-memory.dmp

Filesize
4KB

Download