370a27a30ee57247faddeb1f99a83933247e07c8760a07ed82e451e1cb5e5cdd

Analysis

max time kernel
1794s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 20:40

Target

wdsr040e.dll
Size

60KB
MD5

08b9dbd8b49783f4d04f9ed4b1ecefa7
SHA1

76852aae0722e20e21e67b2fb27f2ff70d5a1f87
SHA256

3bb682f3088fac19c4d53b3766a3793630ea19d2be33cb0f26f7f9e5972dc221
SHA512

429201eef6b9c40d3330345ce2765e8038f488d90bcbf2b315d365f370d00ba2be7b245492b42dadbc220ce464f9b64b1985d4f958e4c9d26aacbd8b854b9c0b
SSDEEP

1536:jxuBkbqIfOtIa6BJjQ8wDl3Di5c2m5CuCam:NuBKqIfOtIa6BJjQ8wDl3Di5c2m5CJD

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 3056 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	3056	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wdsr040e.dll,#1
1⤵
PID:2332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4832 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:1036

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3056

memory/3056-0-0x0000027C6B290000-0x0000027C6B2A0000-memory.dmp

Filesize
64KB

Download
memory/3056-16-0x0000027C6B390000-0x0000027C6B3A0000-memory.dmp

Filesize
64KB

Download
memory/3056-32-0x0000027C73700000-0x0000027C73701000-memory.dmp

Filesize
4KB

Download
memory/3056-34-0x0000027C73730000-0x0000027C73731000-memory.dmp

Filesize
4KB

Download
memory/3056-35-0x0000027C73730000-0x0000027C73731000-memory.dmp

Filesize
4KB

Download
memory/3056-36-0x0000027C73840000-0x0000027C73841000-memory.dmp

Filesize
4KB

Download