547e7122a2b73406687a92ca7969cc0b059a5e02fe2b59b8485c45210a63da3b

Analysis

max time kernel
114s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 06:32

Target

547e7122a2b73406687a92ca7969cc0b059a5e02fe2b59b8485c45210a63da3b.dll
Size

7KB
MD5

815fdc7dbd908c15977a54686d9f0b10
SHA1

d52b5a7274c2297028f31fdc1687ced0ca12eabb
SHA256

547e7122a2b73406687a92ca7969cc0b059a5e02fe2b59b8485c45210a63da3b
SHA512

ae269296a7b0be0456134f45925ecabfdf77c056655c233b5b327084c011d56892a7ec9a7bbd76b97b1dd36ab40f35e2a4a11a9e97dc530cebf60389048346f2
SSDEEP

96:VZpaZjp6hgfzaV1dS2li+QLPJuJmqkm52kB:gZ1l4PiLPAJmqDxB

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4356	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4356	4064	rundll32.exe	83
PID 4064 wrote to memory of 4356	4064	rundll32.exe	83
PID 4064 wrote to memory of 4356	4064	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\547e7122a2b73406687a92ca7969cc0b059a5e02fe2b59b8485c45210a63da3b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\547e7122a2b73406687a92ca7969cc0b059a5e02fe2b59b8485c45210a63da3b.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4356