71eda94c803b87bbd8d32be6ad9f8270d539d75734c46be7c7883352f1927bd5

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 22:55

Target

71eda94c803b87bbd8d32be6ad9f8270d539d75734c46be7c7883352f1927bd5.dll
Size

397KB
MD5

6ce9ff99871c743f1736bab8e2b5242d
SHA1

6dd55285b3a9012dda3f679190aaade1bcc5b5c8
SHA256

71eda94c803b87bbd8d32be6ad9f8270d539d75734c46be7c7883352f1927bd5
SHA512

2f3bc5cdb4d555daaf5846ed0a0aaf523fd02b118f2760f7126fbe2be201a01f1b7682362618cc37db1a7155f4228569c10cf8bc1d13401b05a66bcb045fbf04
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaY:174g2LDeiPDImOkx2LIaY

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3380	rundll32.exe
Token: SeTcbPrivilege	3380	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 3380	2268	rundll32.exe	83
PID 2268 wrote to memory of 3380	2268	rundll32.exe	83
PID 2268 wrote to memory of 3380	2268	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71eda94c803b87bbd8d32be6ad9f8270d539d75734c46be7c7883352f1927bd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\71eda94c803b87bbd8d32be6ad9f8270d539d75734c46be7c7883352f1927bd5.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3380