d748fdbf58ebeb55b1a3fa8291a0e15800445d581cc5547785239b31fd557ad8

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2023, 17:05

Target

d748fdbf58ebeb55b1a3fa8291a0e15800445d581cc5547785239b31fd557ad8.dll
Size

5.5MB
MD5

3e77830d162dd401e5b9df0898161235
SHA1

aefc7887a182c93e4377641b96390aee3452fe21
SHA256

d748fdbf58ebeb55b1a3fa8291a0e15800445d581cc5547785239b31fd557ad8
SHA512

17336dcd984920b00e6c8d073803816b46375923715b9c37e18e482ecc908cff6ed25dbdd43df2987898c13e4ab61c25b55af23f786482b24fa1d6f76e983b7f
SSDEEP

49152:EWLjUR1SVus223vZ6wFg9upkq/bm11GDFOTZaqdwk0c05HGiCP/:3jyIuVwlkKbm1QFOYqdwkLcHHs

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4720	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4720	4600	rundll32.exe	80
PID 4600 wrote to memory of 4720	4600	rundll32.exe	80
PID 4600 wrote to memory of 4720	4600	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d748fdbf58ebeb55b1a3fa8291a0e15800445d581cc5547785239b31fd557ad8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d748fdbf58ebeb55b1a3fa8291a0e15800445d581cc5547785239b31fd557ad8.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4720