902535c8dc8216770afa0d60fac3e8054dea9ed1569bc579cbe00b0b1d377b68

Analysis

max time kernel
1714s
max time network
1783s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 15:27

Target

gta 3/Setap-Filess/WCLDll.dll
Size

590KB
MD5

47eee41b822d953c47434377006e01fe
SHA1

ad42e88bbcce1640aeda1397f82c826ba764d08e
SHA256

218106e2f5ee44e8ae3ecf62e5c2cb1c3db50e5825f4737c9d13bbd48114ed0b
SHA512

443328c44f0d4203c1d7ffc0cce0883c279db9a820e53c5ef4e4711fac451563b4f2ef114c21a4c947212def9f4218ef852ca0e9bfe8a8655668c757f591883f
SSDEEP

12288:D+Se970XqzxUmUkVakh1d4wJjfXB7w86ywKUc6A9iSOJ7zP8cl7ksEjwxtuVOm4:He97qqzxXUkckh1d4wJjfB8vywKUc6Aw

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 884 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	884	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2008 wrote to memory of 3608	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 3608	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 3608	2008	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\gta 3\Setap-Filess\WCLDll.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\gta 3\Setap-Filess\WCLDll.dll",#1
  2⤵
  PID:3608

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:884

memory/884-0-0x000001C452560000-0x000001C452570000-memory.dmp

Filesize
64KB

Download
memory/884-16-0x000001C452660000-0x000001C452670000-memory.dmp

Filesize
64KB

Download
memory/884-32-0x000001C45A9D0000-0x000001C45A9D1000-memory.dmp

Filesize
4KB

Download
memory/884-34-0x000001C45AA00000-0x000001C45AA01000-memory.dmp

Filesize
4KB

Download
memory/884-35-0x000001C45AA00000-0x000001C45AA01000-memory.dmp

Filesize
4KB

Download
memory/884-36-0x000001C45AB10000-0x000001C45AB11000-memory.dmp

Filesize
4KB

Download