402a951848c0c20ce34abf174939e11b5a2df1ccbc887baf836151bc44f58c99

Analysis

max time kernel
93s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 10:00

Target

402a951848c0c20ce34abf174939e11b5a2df1ccbc887baf836151bc44f58c99.dll
Size

397KB
MD5

ed44591f64ac25587a8641884c330279
SHA1

eeaf51c7752d2a8f2c24f32f9b20e2c42c0c3fcb
SHA256

402a951848c0c20ce34abf174939e11b5a2df1ccbc887baf836151bc44f58c99
SHA512

fd1a05030c9e18ebe76469d754cdbb4d201d0adfd729a3ee223bc251994642456794b99b44a760bd0e2e0bed2c37bcf0709d710173c196e443ff871f3ac7a18d
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaR:174g2LDeiPDImOkx2LIaR

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4632	rundll32.exe
Token: SeTcbPrivilege	4632	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4632	4476	rundll32.exe	83
PID 4476 wrote to memory of 4632	4476	rundll32.exe	83
PID 4476 wrote to memory of 4632	4476	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\402a951848c0c20ce34abf174939e11b5a2df1ccbc887baf836151bc44f58c99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\402a951848c0c20ce34abf174939e11b5a2df1ccbc887baf836151bc44f58c99.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4632