fc0d31376fcce0822da0aa6823654ca49766584e9ad3a1d255013d39af23da43

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 15:05

Target

fc0d31376fcce0822da0aa6823654ca49766584e9ad3a1d255013d39af23da43.dll
Size

23KB
MD5

957417a6c595a6a08d2d3b4d6513a83e
SHA1

42ed96c7b3ced84296326bb53c87bec606a7169f
SHA256

fc0d31376fcce0822da0aa6823654ca49766584e9ad3a1d255013d39af23da43
SHA512

d81b3e8101b3d3e4ff0ad364aa63d5d672ecd87ea1fddc833c43ba136be15766b13238f31c58a372cfcc0119f12c2b89e548afb55e59c23bfad62152ef173404
SSDEEP

384:vxG1y3CF9dItBR88LTWdS+1ie//JQ4bitHdtFuFLdIM+tETIaIO58f:pLyF9dx8/L4GtHdtFuFKVETI5O5

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4240	rundll32.exe
4240	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4240	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 4240	3664	rundll32.exe	94
PID 3664 wrote to memory of 4240	3664	rundll32.exe	94
PID 3664 wrote to memory of 4240	3664	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc0d31376fcce0822da0aa6823654ca49766584e9ad3a1d255013d39af23da43.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc0d31376fcce0822da0aa6823654ca49766584e9ad3a1d255013d39af23da43.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4460 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:4220