902535c8dc8216770afa0d60fac3e8054dea9ed1569bc579cbe00b0b1d377b68

Analysis

max time kernel
1714s
max time network
1794s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 15:27

Target

gta 3/Setap-Filess/locale/as_IN/plugins/audio_output/libdirectsound_plugin.dll
Size

51KB
MD5

077990f957556e8a72a37f0ee09a2083
SHA1

371908e5515adb53a57f8d2bda47d59a7346fc1b
SHA256

412f9ec13da17b2f2269567b8397b587352070ce77a641ae40b7a243e26c57ef
SHA512

420d536532ccd474176e2ad2421e655708e0835faa1a60f9b2a70f8a54fdd8d787567c30f478639a367d913b5b34e4e0a81c1c38d95d14351affb25abc536770
SSDEEP

768:htDcW2X9vjCOdZLae3hhwoOzHtdvQEarpDGFhcs3yDGFhed4:ht+X9vj/tJOYrVs1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 2244 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	2244	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2020 wrote to memory of 4000	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 4000	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 4000	2020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\gta 3\Setap-Filess\locale\as_IN\plugins\audio_output\libdirectsound_plugin.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\gta 3\Setap-Filess\locale\as_IN\plugins\audio_output\libdirectsound_plugin.dll",#1
  2⤵
  PID:4000

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2244

memory/2244-0-0x0000023C52190000-0x0000023C521A0000-memory.dmp

Filesize
64KB

Download
memory/2244-16-0x0000023C52290000-0x0000023C522A0000-memory.dmp

Filesize
64KB

Download
memory/2244-32-0x0000023C5A600000-0x0000023C5A601000-memory.dmp

Filesize
4KB

Download
memory/2244-34-0x0000023C5A630000-0x0000023C5A631000-memory.dmp

Filesize
4KB

Download
memory/2244-35-0x0000023C5A630000-0x0000023C5A631000-memory.dmp

Filesize
4KB

Download
memory/2244-36-0x0000023C5A740000-0x0000023C5A741000-memory.dmp

Filesize
4KB

Download