2f2aa69595183cb4388f0d1ef2d585a8bc6f3572282dc344dc29fe7343592fbf

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 17:15

Target

2f2aa69595183cb4388f0d1ef2d585a8bc6f3572282dc344dc29fe7343592fbf.dll
Size

581KB
MD5

830cfdc3f474ad799420751a08ab5580
SHA1

7bab24f20bf473d55c15dd3dba7e17282ecf4b4a
SHA256

2f2aa69595183cb4388f0d1ef2d585a8bc6f3572282dc344dc29fe7343592fbf
SHA512

f54a58281d24b479a27b65800ba03e3edc62dddbbf941febbe0ac38685093d5f8b0de9c55727f3b0e747d7b08660f95e38a1351c0d5548e947527cac9379dd2b
SSDEEP

12288:JnljnqWL24pn75PnR+XklKAlqPPMbQ4Z6hg0t9VoQigohaSYD4rWWkA/0ZNDROU:JlnddR+Xk85PPU5cgyXIhavuS5ZNdOU

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4536	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 4536	2232	rundll32.exe	80
PID 2232 wrote to memory of 4536	2232	rundll32.exe	80
PID 2232 wrote to memory of 4536	2232	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f2aa69595183cb4388f0d1ef2d585a8bc6f3572282dc344dc29fe7343592fbf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f2aa69595183cb4388f0d1ef2d585a8bc6f3572282dc344dc29fe7343592fbf.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4536