03bb030890693d34444019b6ff9ebe145c7da87ee4c4d10c773e86c3d6c74c22

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2023, 17:04

Target

03bb030890693d34444019b6ff9ebe145c7da87ee4c4d10c773e86c3d6c74c22.dll
Size

4.6MB
MD5

bae07d937ec8ba1f057f41c046d2dac6
SHA1

b4e09abb043708e7e540fcdc00cd74c363467cef
SHA256

03bb030890693d34444019b6ff9ebe145c7da87ee4c4d10c773e86c3d6c74c22
SHA512

4592553166fcb920e5860a3504bfe2a74bc87158bdbe1ed53bac525aede91fc5d2bd3fa1e72e92691a30e4e976000099280e9c18d626676487ccfbc4998266d4
SSDEEP

49152:Dt6k7xyjHqY4WjaLn3GpCuF4+qc4C+gUO9TLQnqohN1Sgxxp:r7P1Ln3GQuF4+qco7OtQqY1SI

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1032	rundll32.exe
1032	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	rundll32.exe
Token: SeDebugPrivilege	1032	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1032	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 1032	4976	rundll32.exe	83
PID 4976 wrote to memory of 1032	4976	rundll32.exe	83
PID 4976 wrote to memory of 1032	4976	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03bb030890693d34444019b6ff9ebe145c7da87ee4c4d10c773e86c3d6c74c22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\03bb030890693d34444019b6ff9ebe145c7da87ee4c4d10c773e86c3d6c74c22.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1032