622247b879e1bdb2c65694801418e7c52eb132dcd70ae65237bed366031ff71a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 04:14

Target

622247b879e1bdb2c65694801418e7c52eb132dcd70ae65237bed366031ff71a.dll
Size

397KB
MD5

15d995b5b50994411531d43a2780dc1c
SHA1

d13bae3416d3d33177c31854b0d446d3ac7c60d5
SHA256

622247b879e1bdb2c65694801418e7c52eb132dcd70ae65237bed366031ff71a
SHA512

50b443dfd696d2766b624b7b78cc564d6b51032995844d8fbdcaff4b21efc742c7d3288353ad2a88cd588484b17938824537b3a8f0846867449944f362be8bcb
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa3:174g2LDeiPDImOkx2LIa3

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	rundll32.exe
Token: SeTcbPrivilege	2644	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 2644	4856	rundll32.exe	85
PID 4856 wrote to memory of 2644	4856	rundll32.exe	85
PID 4856 wrote to memory of 2644	4856	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\622247b879e1bdb2c65694801418e7c52eb132dcd70ae65237bed366031ff71a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\622247b879e1bdb2c65694801418e7c52eb132dcd70ae65237bed366031ff71a.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2644