6acc1c7e0ecca172fbccf4afa293d0366f40df60b27bed0a48fec06de2c2fada

Analysis

max time kernel
96s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 07:34

Target

6acc1c7e0ecca172fbccf4afa293d0366f40df60b27bed0a48fec06de2c2fada.dll
Size

215KB
MD5

1a8cf16a85361aa8cc2d140347b1dd79
SHA1

bc0d4e5fffc7bcc8c34ce4c90ba2a08412b582b2
SHA256

6acc1c7e0ecca172fbccf4afa293d0366f40df60b27bed0a48fec06de2c2fada
SHA512

281302a35e03430f299d75b9049cbdcc36ff5e09d733b098d656ddc5ceefd4109e86ec77be8fd4b1ad51ab03d320437a87630cf084f7bf5e9fb865e7ee84a228
SSDEEP

3072:JmZg+h/VgSUajU3XbZFHQY+hSZ7KYwIHPrJxSgUPeMY1+Ns5t8Lv0cW4CFUXv/R7:JmZg+CajU3LH+hqKYw4xieMYz8YlQr

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2228	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 2228	4984	rundll32.exe	81
PID 4984 wrote to memory of 2228	4984	rundll32.exe	81
PID 4984 wrote to memory of 2228	4984	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6acc1c7e0ecca172fbccf4afa293d0366f40df60b27bed0a48fec06de2c2fada.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6acc1c7e0ecca172fbccf4afa293d0366f40df60b27bed0a48fec06de2c2fada.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2228

memory/2228-133-0x00000000027A0000-0x00000000027C5000-memory.dmp

Filesize
148KB

Download
memory/2228-134-0x00000000027D0000-0x0000000002808000-memory.dmp

Filesize
224KB

Download
memory/2228-138-0x00000000027A0000-0x00000000027C5000-memory.dmp

Filesize
148KB

Download
memory/2228-139-0x00000000027A0000-0x00000000027C5000-memory.dmp

Filesize
148KB

Download