d3b373783bf200ce4fded5f5ab1364c051bd8f5e1f3feda64b4b86115c175cfb

Analysis

max time kernel
138s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 15:01

Target

d3b373783bf200ce4fded5f5ab1364c051bd8f5e1f3feda64b4b86115c175cfb.dll
Size

33KB
MD5

709ea79521aeff95f0ceabe89c80c332
SHA1

305a7921f6944f5b307a2978c90d329349b22105
SHA256

d3b373783bf200ce4fded5f5ab1364c051bd8f5e1f3feda64b4b86115c175cfb
SHA512

4c8a285860da735209dc0f2ae4061cf48a9c2e7a329774e9eff4d34523fc36bd175308b5ec8d2a8de576346b0f0415ba45f43fc983be5bf161bc70133ee93a0b
SSDEEP

768:m+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:m+av6qZ4QxpP0AtNfRJ5BHxY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1440	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 1440	424	rundll32.exe	82
PID 424 wrote to memory of 1440	424	rundll32.exe	82
PID 424 wrote to memory of 1440	424	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3b373783bf200ce4fded5f5ab1364c051bd8f5e1f3feda64b4b86115c175cfb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3b373783bf200ce4fded5f5ab1364c051bd8f5e1f3feda64b4b86115c175cfb.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1440