d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f

Analysis

max time kernel
134s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 10:23

Target

d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f.dll
Size

397KB
MD5

e7fba96ab6522a0cbcc89b3340dc0146
SHA1

4ee9816f580572897e4abe2050d86807004c3017
SHA256

d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f
SHA512

6bb8b6c5affa6a0409f636fa8611e25e562a2a0f654d2dad0dd8f95e6469a72f441d1ceb7a0198c6bf65280b4fdb555a6d0fc8678efc650ebf1c609c7dcfb0ac
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOal:174g2LDeiPDImOkx2LIal

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	rundll32.exe
Token: SeTcbPrivilege	3684	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 3684	2512	rundll32.exe	86
PID 2512 wrote to memory of 3684	2512	rundll32.exe	86
PID 2512 wrote to memory of 3684	2512	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3684