2bb3bd027206f7a549c47feabd1ec880c4cf6aa90c3befe213a45d8372897913

Analysis

max time kernel
162s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 20:43

Target

2bb3bd027206f7a549c47feabd1ec880c4cf6aa90c3befe213a45d8372897913.dll
Size

3.0MB
MD5

e2cf78cd4c8bdfe435a4adca8b2da51c
SHA1

6d186ba360876073bdce6b8e489829360f3f2431
SHA256

2bb3bd027206f7a549c47feabd1ec880c4cf6aa90c3befe213a45d8372897913
SHA512

f2ab8e347a09ee5d8a02f6227cb5da34da927d4c40d1b6ae5f20b2c118ce436f0567227f3afe09388f23d6d834da00efe897105ecc370f61a7762c0da79465c0
SSDEEP

49152:NOLmDDsmL+nzn2wiCLjcNAtJxE8f+s8KuqGaX0ToIBAUZLYcce:gSDYmqKwrLjhfW3JBAUZLTc

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4000	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 4000	4852	rundll32.exe	81
PID 4852 wrote to memory of 4000	4852	rundll32.exe	81
PID 4852 wrote to memory of 4000	4852	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bb3bd027206f7a549c47feabd1ec880c4cf6aa90c3befe213a45d8372897913.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bb3bd027206f7a549c47feabd1ec880c4cf6aa90c3befe213a45d8372897913.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4000