902535c8dc8216770afa0d60fac3e8054dea9ed1569bc579cbe00b0b1d377b68

Analysis

max time kernel
1713s
max time network
1801s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 15:27

Target

gta 3/Setap-Filess/locale/as_IN/plugins/codec/libd3d11va_plugin.dll
Size

267KB
MD5

1137f05e3030ce4031dfa68731650f25
SHA1

c1e78b9ad6c834d71b0f42ca0f4932f37b7b1579
SHA256

c5cea8862585850e651cbcc5883c70ce7d54e1871b53905b210b55ed9bc1fab1
SHA512

7b03d88f75a30cea02c766741550fb781f7a9a9472145558989e90cb8294f58d7104c79f94f2775fdb90edd38580d189816e63e56aa7c5f022e85d8bcab20a2c
SSDEEP

3072:66Auodqwn3PeCVFB5D9vQh9elVlUfJ36XkGF16EuEt75P7gKwO:6puodqe3RH5pvQHelVlJk81rZt1zgKT

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 4860 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	4860	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2732 wrote to memory of 820	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 820	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 820	2732	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\gta 3\Setap-Filess\locale\as_IN\plugins\codec\libd3d11va_plugin.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\gta 3\Setap-Filess\locale\as_IN\plugins\codec\libd3d11va_plugin.dll",#1
  2⤵
  PID:820

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4860

memory/4860-0-0x000001B7FFD00000-0x000001B7FFD10000-memory.dmp

Filesize
64KB

Download
memory/4860-16-0x000001B7FFE00000-0x000001B7FFE10000-memory.dmp

Filesize
64KB

Download
memory/4860-32-0x000001B788530000-0x000001B788531000-memory.dmp

Filesize
4KB

Download
memory/4860-34-0x000001B788560000-0x000001B788561000-memory.dmp

Filesize
4KB

Download
memory/4860-35-0x000001B788560000-0x000001B788561000-memory.dmp

Filesize
4KB

Download
memory/4860-36-0x000001B788670000-0x000001B788671000-memory.dmp

Filesize
4KB

Download