69301c671e3720a72c5d6a2ac82ec59f0cdefd2c907b3a4475987612f15d6226

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 11:39

Target

69301c671e3720a72c5d6a2ac82ec59f0cdefd2c907b3a4475987612f15d6226.dll
Size

28KB
MD5

7fca87c8ec536545f88117b1a32def62
SHA1

dc347398c9bd3fd2e24d634af8e00af4d9c95dcc
SHA256

69301c671e3720a72c5d6a2ac82ec59f0cdefd2c907b3a4475987612f15d6226
SHA512

c97bd4076f3008570453c1e018a3e2d5ad0856a83cbd234978a65078ff0709e97d6e973dbeabbd870a99f91d3dc1c888415e5d2939e28b56e48701fd2d3dab6c
SSDEEP

384:6B0wjhgvb6E0IXBBy//Zcf2e9Rg3G8v/HI9Q:6BbjhzE1OpI2eQG8v/H

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	2708	rundll32.exe
16	2708	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2708	rundll32.exe
2708	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 2708	3568	rundll32.exe	84
PID 3568 wrote to memory of 2708	3568	rundll32.exe	84
PID 3568 wrote to memory of 2708	3568	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\69301c671e3720a72c5d6a2ac82ec59f0cdefd2c907b3a4475987612f15d6226.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\69301c671e3720a72c5d6a2ac82ec59f0cdefd2c907b3a4475987612f15d6226.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708

C:\Users\Admin\AppData\Local\Temp\iod.zp

Filesize
353B

MD5
f719eb36927766b99edbfd3b1487ceb0

SHA1
a2789c590f5f3b367a6dd19902fd2256d30eff08

SHA256
5ec6ed16a13a00b784451e4f8bf2fb91c72ac72464ebcfd1c3e9387b336873c8

SHA512
093216c21044c36e6740a513796e57afe69de66cee357b63fa1b96f4bd6dce17590aa4fa1a39bab59d604e25bc2a652f23b38cb6132b807e16e850bc9e91d5ef

Download Submit