a453b0b4e2409563a4007f9bf7b20a8fcf076ac46a7100932182c806ce95faa7

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2022, 21:03

Target

a453b0b4e2409563a4007f9bf7b20a8fcf076ac46a7100932182c806ce95faa7.dll
Size

1.3MB
MD5

96fdff10a73de868ea81c7be36dcfdb2
SHA1

d8637eff8b78ef3c721ea57195170858958a85d5
SHA256

a453b0b4e2409563a4007f9bf7b20a8fcf076ac46a7100932182c806ce95faa7
SHA512

b798da806c3e867dd155d444b79eac87e950750119476985a7a84388cdc32d3c7d37d80f9830ad33e6a1dc264d39f74c307ef36e0b9555d7e82076b611d90c41
SSDEEP

24576:iVG+QCfNi/wd0wzdHOQIIXUFMkcPLOmRxzNpMHjHB2/vD:lqBdLzdHxI5ByzNaHjHG

Score

1^/10

Suspicious use of SetWindowsHookEx 23 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 1236	4684	rundll32.exe	78
PID 4684 wrote to memory of 1236	4684	rundll32.exe	78
PID 4684 wrote to memory of 1236	4684	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a453b0b4e2409563a4007f9bf7b20a8fcf076ac46a7100932182c806ce95faa7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a453b0b4e2409563a4007f9bf7b20a8fcf076ac46a7100932182c806ce95faa7.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1236

memory/1236-133-0x0000000010000000-0x000000001020D000-memory.dmp

Filesize
2.1MB

Download
memory/1236-135-0x0000000010000000-0x000000001020D000-memory.dmp

Filesize
2.1MB

Download
memory/1236-134-0x0000000010000000-0x000000001020D000-memory.dmp

Filesize
2.1MB

Download
memory/1236-136-0x0000000010000000-0x000000001020D000-memory.dmp

Filesize
2.1MB

Download