1dfdd5e0c7f45aaa085f152e7d81d45a3034c1992809322af421f948615cf45b

Analysis

max time kernel
84s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 09:56

Target

1dfdd5e0c7f45aaa085f152e7d81d45a3034c1992809322af421f948615cf45b.dll
Size

173KB
MD5

f7fecd372cdc481f0fe5b37cd8b06e75
SHA1

080bda91b711db70f2abe554ca8e8914ce3e4557
SHA256

1dfdd5e0c7f45aaa085f152e7d81d45a3034c1992809322af421f948615cf45b
SHA512

87b6aca8bbeb800660fba888fbb5e94a9f1131d7f2ccfa4d8dfdbe489c930fe665017096d2efe02daa890379db93580f756858024e50d4ecf5e299ed93c68909
SSDEEP

3072:wzXX/wvYsFDXMpkiw/vLjUmK+g06ckzerFIMQC4JO4D1vLB:EXIw+G6Ej0kzeIMQC4I4D1vL

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3408	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 3408	1748	rundll32.exe	86
PID 1748 wrote to memory of 3408	1748	rundll32.exe	86
PID 1748 wrote to memory of 3408	1748	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfdd5e0c7f45aaa085f152e7d81d45a3034c1992809322af421f948615cf45b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfdd5e0c7f45aaa085f152e7d81d45a3034c1992809322af421f948615cf45b.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3408