6f8ae5afbe867e6e6cccefec267b5f93c73ab2bf3a5a553491f0fc9be52b822e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 13:02

Target

6f8ae5afbe867e6e6cccefec267b5f93c73ab2bf3a5a553491f0fc9be52b822e.dll
Size

397KB
MD5

99ec38334382232af78359905af71a70
SHA1

e0c164fddd79cc3fd08bf6c681a09c02aeee0b90
SHA256

6f8ae5afbe867e6e6cccefec267b5f93c73ab2bf3a5a553491f0fc9be52b822e
SHA512

0d80b148852e843cfe62a687c81c4d34522219ec76c23793cc200fef204d01efc10fbb42b50ba467a40c2e3e82c9170648c86f503fe377d2b6a90508dba91484
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaq:174g2LDeiPDImOkx2LIaq

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	rundll32.exe
Token: SeTcbPrivilege	5028	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 5028	3244	rundll32.exe	86
PID 3244 wrote to memory of 5028	3244	rundll32.exe	86
PID 3244 wrote to memory of 5028	3244	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f8ae5afbe867e6e6cccefec267b5f93c73ab2bf3a5a553491f0fc9be52b822e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f8ae5afbe867e6e6cccefec267b5f93c73ab2bf3a5a553491f0fc9be52b822e.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5028