cf22e18ad29c0798eb3d5728cb5198a923cc7b137dcd0b4c193ab09df3c83c6b

Analysis

max time kernel
145s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 09:40

Target

cf22e18ad29c0798eb3d5728cb5198a923cc7b137dcd0b4c193ab09df3c83c6b.dll
Size

82KB
MD5

3a94a6c0a88c9ab931278d5df098822b
SHA1

2c6eea477d2184dc786ac1ab2c184299ca907a1e
SHA256

cf22e18ad29c0798eb3d5728cb5198a923cc7b137dcd0b4c193ab09df3c83c6b
SHA512

e9d5458c0876fe03c8fd88c94f8e0e27322e84d4156dab574c951028d907aec87103a0b14e2eae8abea32623debb7dc4d4a4a0f8b00bfc74ed9f3b86d9273979
SSDEEP

1536:alo/VcENLJJ10quYOqgTEa/PNgpMzBbd8B4fmhA8mW2:aUlNlJ10FNlNg+sbO

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1828	rundll32.exe
1828	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 1828	4208	rundll32.exe	80
PID 4208 wrote to memory of 1828	4208	rundll32.exe	80
PID 4208 wrote to memory of 1828	4208	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf22e18ad29c0798eb3d5728cb5198a923cc7b137dcd0b4c193ab09df3c83c6b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf22e18ad29c0798eb3d5728cb5198a923cc7b137dcd0b4c193ab09df3c83c6b.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1828

memory/1828-133-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1828-134-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download