ae1cf92e9dadab32511a02e456b033a513a92f97d21dae6928faa36d4ef0675d

Analysis

max time kernel
124s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 20:32

Target

ae1cf92e9dadab32511a02e456b033a513a92f97d21dae6928faa36d4ef0675d.dll
Size

397KB
MD5

d31456945338d06d29684a418649608f
SHA1

0f22a378eaed6004bdd3f3d118f1e0fea4f3e333
SHA256

ae1cf92e9dadab32511a02e456b033a513a92f97d21dae6928faa36d4ef0675d
SHA512

a202f682db96d58b3f4ebf442eba8e8a64317b531436bf4546d930992dc6200c3c59fda39ac4a107f52d7119c0d5359cdaaea59fe10387b9ade18ba54d319f01
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaD:174g2LDeiPDImOkx2LIaD

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	208	rundll32.exe
Token: SeTcbPrivilege	208	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 208	5064	rundll32.exe	88
PID 5064 wrote to memory of 208	5064	rundll32.exe	88
PID 5064 wrote to memory of 208	5064	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae1cf92e9dadab32511a02e456b033a513a92f97d21dae6928faa36d4ef0675d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae1cf92e9dadab32511a02e456b033a513a92f97d21dae6928faa36d4ef0675d.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1308,i,7593277344190429033,13055212002259797845,262144 --variations-seed-version --mojo-platform-channel-handle=1012 /prefetch:8
1⤵
PID:3276