d368060877682ed7244b1a516e36f094f68d8747c1f300d42c7710326b997a09

Analysis

max time kernel
106s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2023, 19:51

Target

d368060877682ed7244b1a516e36f094f68d8747c1f300d42c7710326b997a09.dll
Size

1020KB
MD5

b96cb821beb539b4de05cc3d0e8d7f13
SHA1

7b317903ce05d656fb6e1df5a73ce9afb4c795b2
SHA256

d368060877682ed7244b1a516e36f094f68d8747c1f300d42c7710326b997a09
SHA512

694663a79341ba44e16adee9814a1b2b007d1838aaaf54320a8c26ff90e7146be84f060f3137da620b0c3b65deef02b8d0fc74b45ac66c34d176c8dadc762f20
SSDEEP

24576:6ugthMpJ44s5Zn2TTvEiR8w2il0dowx2mpx1Kv:6dXZCYw21tFpOv

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1564	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1564	2348	rundll32.exe	82
PID 2348 wrote to memory of 1564	2348	rundll32.exe	82
PID 2348 wrote to memory of 1564	2348	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d368060877682ed7244b1a516e36f094f68d8747c1f300d42c7710326b997a09.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d368060877682ed7244b1a516e36f094f68d8747c1f300d42c7710326b997a09.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1564