eff627a2e67f9f9905836f4752d96d851107acd235d75efcbc7d297675161764

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 14:04

Target

eff627a2e67f9f9905836f4752d96d851107acd235d75efcbc7d297675161764.dll
Size

397KB
MD5

06389b8e19cc147f77ec6dbb21cf887d
SHA1

9bfa0007984f6693c1243d787c31bfb2571e7d68
SHA256

eff627a2e67f9f9905836f4752d96d851107acd235d75efcbc7d297675161764
SHA512

9206f6eb54f7a4abb7985860548a571568b7babd288cb68d12294c1b11859996545f3dd9207d6dca9c6a330472ed7b92dcc46d5b0d9ee7ecbe22388f49747805
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaM:174g2LDeiPDImOkx2LIaM

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	632	rundll32.exe
Token: SeTcbPrivilege	632	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 632	3928	rundll32.exe	92
PID 3928 wrote to memory of 632	3928	rundll32.exe	92
PID 3928 wrote to memory of 632	3928	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eff627a2e67f9f9905836f4752d96d851107acd235d75efcbc7d297675161764.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eff627a2e67f9f9905836f4752d96d851107acd235d75efcbc7d297675161764.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:1612