6491f22b8934eecdf1fbb8165e428aeab2d599e67733ec19d4e6b4bf3d0f295f

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 16:27

Target

6491f22b8934eecdf1fbb8165e428aeab2d599e67733ec19d4e6b4bf3d0f295f.dll
Size

96KB
MD5

3b7ec1a21ca1c445d404d51c85a2a08f
SHA1

3135f9cc209f459bfa449cec568054b41e12a78b
SHA256

6491f22b8934eecdf1fbb8165e428aeab2d599e67733ec19d4e6b4bf3d0f295f
SHA512

05cabed042ec440fc21635f5a2a9bfe78e4704b773da5a751282be805644a8d5bdff8310e55a12b1dd539e1386e6792a2feec20590bb79b0173b1c4ab582eb6e
SSDEEP

1536:1jbgsBJwMOdETcoEdmNqSm15xUyjED7T8s1Njj/unpj2g8rcBinj5+zzd:1xJXEkqSm3x63vNZgGnj5+zzd

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5036	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 5036	4624	rundll32.exe	76
PID 4624 wrote to memory of 5036	4624	rundll32.exe	76
PID 4624 wrote to memory of 5036	4624	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6491f22b8934eecdf1fbb8165e428aeab2d599e67733ec19d4e6b4bf3d0f295f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6491f22b8934eecdf1fbb8165e428aeab2d599e67733ec19d4e6b4bf3d0f295f.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5036

memory/5036-132-0x0000000000000000-mapping.dmp

Download
memory/5036-133-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/5036-134-0x0000000000A10000-0x0000000000A22000-memory.dmp

Filesize
72KB

Download
memory/5036-135-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/5036-136-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download