60809b392b7980d5e2174636544ec576f9ebedd44741a9a5bb7bf8e3679c9b3e

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 22:38

Target

60809b392b7980d5e2174636544ec576f9ebedd44741a9a5bb7bf8e3679c9b3e.dll
Size

397KB
MD5

4cae51e3a49568205822a51781f4f524
SHA1

af8c6229165abb32f23529e394c653b25f758d74
SHA256

60809b392b7980d5e2174636544ec576f9ebedd44741a9a5bb7bf8e3679c9b3e
SHA512

951431817b359d8fc3ed4e823abf8162f591bf7fc71591f6d572c0a9d79991bfe04e94e992edb6686bc5b2c7b8b15272c42e2786a4c2f252a1827b44dc1485ce
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOag:174g2LDeiPDImOkx2LIag

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	rundll32.exe
Token: SeTcbPrivilege	2380	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2380	3264	rundll32.exe	91
PID 3264 wrote to memory of 2380	3264	rundll32.exe	91
PID 3264 wrote to memory of 2380	3264	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60809b392b7980d5e2174636544ec576f9ebedd44741a9a5bb7bf8e3679c9b3e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60809b392b7980d5e2174636544ec576f9ebedd44741a9a5bb7bf8e3679c9b3e.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:3580