8ae4e51ba3cabc2a5d75039bc6f184d889b1960de79c0020ec8da3e99acca05f

Analysis

max time kernel
195s
max time network
238s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 05:08

Target

8ae4e51ba3cabc2a5d75039bc6f184d889b1960de79c0020ec8da3e99acca05f.dll
Size

87KB
MD5

4b33713b17c670915a05dbe3485da2e0
SHA1

14315cc6f8d0e8857abf19854545ad0c1c2a9798
SHA256

8ae4e51ba3cabc2a5d75039bc6f184d889b1960de79c0020ec8da3e99acca05f
SHA512

b49ea9d1b975a04e6281bd9b9380ef62e507aa1267e2c614e251575aacbb555e69a4cc38148ffbfa4edc619cb808a32b3012fd13dda3a8adda4ae8f3b33354c8
SSDEEP

1536:bcJw/ENj2+tv8suXp4FqUtt+MATom8LwT7MJ7nqUZRtdFQuZSR/BFFEppRAf5:bcJwMNPtv8DCtt+Xo3wTEntRyRHGpRA5

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4836	rundll32.exe
4836	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 4836	2832	rundll32.exe	79
PID 2832 wrote to memory of 4836	2832	rundll32.exe	79
PID 2832 wrote to memory of 4836	2832	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ae4e51ba3cabc2a5d75039bc6f184d889b1960de79c0020ec8da3e99acca05f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ae4e51ba3cabc2a5d75039bc6f184d889b1960de79c0020ec8da3e99acca05f.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4836

memory/4836-133-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/4836-134-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download