fde3549d81830f77d59ebecfaf03e771cd94bf2d4906de02018060a1ccce3373

Analysis

max time kernel
118s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 12:59

Target

fde3549d81830f77d59ebecfaf03e771cd94bf2d4906de02018060a1ccce3373.dll
Size

29KB
MD5

6034b11a2508aa71a1debae93ae2aef8
SHA1

5ab1f59fcd2372232358e9a27a2a399a5a20e8f3
SHA256

fde3549d81830f77d59ebecfaf03e771cd94bf2d4906de02018060a1ccce3373
SHA512

73c549eb4410f330905901db1f4f433a00e082fef882c933dad1f35295edb8708af2c49f265e295c24bc49329c6ab6aa1c520c42ee3c84dc39b54ca75331fefc
SSDEEP

768:81dSJtroAz7mhUqLi/DjZNmDJSHOwnEFr+Vm:Eyoumh5O/Dbor+

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2100	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 2100	3176	rundll32.exe	84
PID 3176 wrote to memory of 2100	3176	rundll32.exe	84
PID 3176 wrote to memory of 2100	3176	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fde3549d81830f77d59ebecfaf03e771cd94bf2d4906de02018060a1ccce3373.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fde3549d81830f77d59ebecfaf03e771cd94bf2d4906de02018060a1ccce3373.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2100