cf2c8e6ad1a0182910183b177ebf6aab6d168bb4bdbf964e10009a8b9f881a21

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 19:36

Target

cf2c8e6ad1a0182910183b177ebf6aab6d168bb4bdbf964e10009a8b9f881a21.dll
Size

64KB
MD5

8c0296fe9887a0dc58cc749ccec370b6
SHA1

7d84be306ed5c7212e433c16b00bc69cd10fabed
SHA256

cf2c8e6ad1a0182910183b177ebf6aab6d168bb4bdbf964e10009a8b9f881a21
SHA512

d1139b36fbee9db6aa95fb4fa6b2cb01a0a60b3503aef2413b3d9b16c52a65c68f5aef5af9a3d8b2435019c37f524751c5cbc7f664851bd6d34bdb065e604843
SSDEEP

768:OEy7KklIoGTzHMBxf82Vj86uNNS+8iUaqzcdECsVaKYVrBBzFQ0:nJIVqHM38CuNNV2VCswzFQ0

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1764	rundll32.exe
1764	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 1764	444	rundll32.exe	72
PID 444 wrote to memory of 1764	444	rundll32.exe	72
PID 444 wrote to memory of 1764	444	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf2c8e6ad1a0182910183b177ebf6aab6d168bb4bdbf964e10009a8b9f881a21.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf2c8e6ad1a0182910183b177ebf6aab6d168bb4bdbf964e10009a8b9f881a21.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1764