03bb030890693d34444019b6ff9ebe145c7da87ee4c4d10c773e86c3d6c74c22

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24/11/2023, 17:04

Target

03bb030890693d34444019b6ff9ebe145c7da87ee4c4d10c773e86c3d6c74c22.dll
Size

4.6MB
MD5

bae07d937ec8ba1f057f41c046d2dac6
SHA1

b4e09abb043708e7e540fcdc00cd74c363467cef
SHA256

03bb030890693d34444019b6ff9ebe145c7da87ee4c4d10c773e86c3d6c74c22
SHA512

4592553166fcb920e5860a3504bfe2a74bc87158bdbe1ed53bac525aede91fc5d2bd3fa1e72e92691a30e4e976000099280e9c18d626676487ccfbc4998266d4
SSDEEP

49152:Dt6k7xyjHqY4WjaLn3GpCuF4+qc4C+gUO9TLQnqohN1Sgxxp:r7P1Ln3GQuF4+qco7OtQqY1SI

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2364	rundll32.exe
2364	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	rundll32.exe
Token: SeDebugPrivilege	2364	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2364	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2364	2228	rundll32.exe	28
PID 2228 wrote to memory of 2364	2228	rundll32.exe	28
PID 2228 wrote to memory of 2364	2228	rundll32.exe	28
PID 2228 wrote to memory of 2364	2228	rundll32.exe	28
PID 2228 wrote to memory of 2364	2228	rundll32.exe	28
PID 2228 wrote to memory of 2364	2228	rundll32.exe	28
PID 2228 wrote to memory of 2364	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03bb030890693d34444019b6ff9ebe145c7da87ee4c4d10c773e86c3d6c74c22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\03bb030890693d34444019b6ff9ebe145c7da87ee4c4d10c773e86c3d6c74c22.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2364