69a387ddc0217a50abb8e6e31bcca8a0c0195da67775ef07db0e27129fd08d5e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 21:33

Target

69a387ddc0217a50abb8e6e31bcca8a0c0195da67775ef07db0e27129fd08d5e.dll
Size

397KB
MD5

c539463f317a321cdbd11d8b7198447b
SHA1

4b77a71453693360374e7fea325e01bd0b6f7311
SHA256

69a387ddc0217a50abb8e6e31bcca8a0c0195da67775ef07db0e27129fd08d5e
SHA512

31693122029d73769390422f3ba21e94db9e246f3b4099b667fe0f4e663c61756765ea811ec3a0af11f4c80d7c72c1681558297aa91536b1968ef3ca153f9a1c
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaY:174g2LDeiPDImOkx2LIaY

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	rundll32.exe
Token: SeTcbPrivilege	1856	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 1856	3944	rundll32.exe	83
PID 3944 wrote to memory of 1856	3944	rundll32.exe	83
PID 3944 wrote to memory of 1856	3944	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\69a387ddc0217a50abb8e6e31bcca8a0c0195da67775ef07db0e27129fd08d5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\69a387ddc0217a50abb8e6e31bcca8a0c0195da67775ef07db0e27129fd08d5e.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856