58221da50455e284a43688a4c99c6c70205c165cbcc7aa1c6575254ca3a6d9c5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 20:57

Target

58221da50455e284a43688a4c99c6c70205c165cbcc7aa1c6575254ca3a6d9c5.dll
Size

397KB
MD5

9436a4bdc916d8ac0c78382770cc285d
SHA1

2d2127329b2586725cac061810ddbdd6ffe424f8
SHA256

58221da50455e284a43688a4c99c6c70205c165cbcc7aa1c6575254ca3a6d9c5
SHA512

94807ae9e8041e11c94c142aa62755ba0d47576c73bf48a24f935c4af12707eb91d17bdf8e99ca526cda597f378a306e0c7e4b795237fc166e96da8d9949c8c4
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOah:174g2LDeiPDImOkx2LIah

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4700	rundll32.exe
Token: SeTcbPrivilege	4700	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 4700	3728	rundll32.exe	84
PID 3728 wrote to memory of 4700	3728	rundll32.exe	84
PID 3728 wrote to memory of 4700	3728	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58221da50455e284a43688a4c99c6c70205c165cbcc7aa1c6575254ca3a6d9c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\58221da50455e284a43688a4c99c6c70205c165cbcc7aa1c6575254ca3a6d9c5.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4700