e678af69ffb103bcf372d6190f4987fc5ca7fd4ab89e992c2c3d98aec6b7073c

Analysis

max time kernel
135s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 15:33

Target

e678af69ffb103bcf372d6190f4987fc5ca7fd4ab89e992c2c3d98aec6b7073c.dll
Size

397KB
MD5

e1072e0d91f84964ca6ed817f9aecba2
SHA1

dd778e5924939aad7dd5b94832071883b1d2501c
SHA256

e678af69ffb103bcf372d6190f4987fc5ca7fd4ab89e992c2c3d98aec6b7073c
SHA512

973019a686276ce8e3ff3f8422b2e113661a5123eb6394def2458872d95b789d025f152b5c9a800a4febe38fb79a9e5ae286022f48855f0234e46cd6d2028da6
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOao:174g2LDeiPDImOkx2LIao

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4412	rundll32.exe
Token: SeTcbPrivilege	4412	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 4412	5096	rundll32.exe	90
PID 5096 wrote to memory of 4412	5096	rundll32.exe	90
PID 5096 wrote to memory of 4412	5096	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e678af69ffb103bcf372d6190f4987fc5ca7fd4ab89e992c2c3d98aec6b7073c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e678af69ffb103bcf372d6190f4987fc5ca7fd4ab89e992c2c3d98aec6b7073c.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4412