12c8a9ab93649f8c75399b6b96f4c54e7454cd0eaa25090dc53c223788c85222

Resubmissions

25/04/2024, 20:51

25/04/2024, 20:47

max time kernel
1383s
max time network
1166s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 20:47

Target

runtimes/win-x86/native/onnxruntime.dll
Size

11.3MB
MD5

c729f190fc5e167957b6b2b5161c9311
SHA1

7bff0b54c05c1f12e317e115551be239296a902c
SHA256

9aac6501125a2d3c32d0fb9595c94e373038b162fca46207dd161645e09ed920
SHA512

2d250cb0cb0c842a8b616e8539ba71822535915fa089b2f5ae95aec2eb4a9d689f1a1ee86e1eeb14797e8b5e49c107208ff03ce897fb4d3b33d70492812f1a79
SSDEEP

196608:8wkiQfuSJkmK8Lkciy8G+4EEhWTIP2jv1b8gVhTIRhHQldBTlaCoAEO1CtUPC2k+:8aQfuSJKciy834EEhWTIP2p8gVhTIRB2

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	364	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 3968	3332	rundll32.exe	85
PID 3332 wrote to memory of 3968	3332	rundll32.exe	85
PID 3332 wrote to memory of 3968	3332	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\runtimes\win-x86\native\onnxruntime.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\runtimes\win-x86\native\onnxruntime.dll,#1
  2⤵
  PID:3968

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:364

memory/364-0-0x0000022C35740000-0x0000022C35750000-memory.dmp

Filesize
64KB

Download
memory/364-16-0x0000022C35840000-0x0000022C35850000-memory.dmp

Filesize
64KB

Download
memory/364-32-0x0000022C3DB90000-0x0000022C3DB91000-memory.dmp

Filesize
4KB

Download
memory/364-34-0x0000022C3DBC0000-0x0000022C3DBC1000-memory.dmp

Filesize
4KB

Download
memory/364-35-0x0000022C3DBC0000-0x0000022C3DBC1000-memory.dmp

Filesize
4KB

Download
memory/364-36-0x0000022C3DCD0000-0x0000022C3DCD1000-memory.dmp

Filesize
4KB

Download