75169cb08592cf9a77ca862a33b88d8ea4e065f2d83cd091a256f19d35d63521

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 22:27

Target

75169cb08592cf9a77ca862a33b88d8ea4e065f2d83cd091a256f19d35d63521.dll
Size

397KB
MD5

bf91f737c57f69fe80272f8ab1fb02c0
SHA1

3de7e56d88f1bae7df066bf38dc897f781046776
SHA256

75169cb08592cf9a77ca862a33b88d8ea4e065f2d83cd091a256f19d35d63521
SHA512

4858c23498d8b53e835d3c0f6d2f30cf7352e17576a62fd84cbcce184f60c85c5175f92651404a1397b950409176ca0e195c2b80f40f8b39aac6f3a3418fc222
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaD:174g2LDeiPDImOkx2LIaD

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3900	rundll32.exe
Token: SeTcbPrivilege	3900	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 3900	3764	rundll32.exe	87
PID 3764 wrote to memory of 3900	3764	rundll32.exe	87
PID 3764 wrote to memory of 3900	3764	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75169cb08592cf9a77ca862a33b88d8ea4e065f2d83cd091a256f19d35d63521.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\75169cb08592cf9a77ca862a33b88d8ea4e065f2d83cd091a256f19d35d63521.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3900