d5aa25c0ff26479b0662e7e6b413695e776d351098db82f6b80f3606e6c6bdf1

Analysis

max time kernel
122s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 10:14

Target

d5aa25c0ff26479b0662e7e6b413695e776d351098db82f6b80f3606e6c6bdf1.dll
Size

892KB
MD5

080016d271e61e5e472aeef81fac8d80
SHA1

a1abbcb06304799c6982230a12aae3316023ec50
SHA256

d5aa25c0ff26479b0662e7e6b413695e776d351098db82f6b80f3606e6c6bdf1
SHA512

7f98bf9e2ef8a0a60bda0cc1b26e849c849a2c303f7cf83dfa7b44bc0c0e5d9958174df29ac593059fcbb595c21cdfef167de296dbd1656d06f5e3064986c186
SSDEEP

24576:loztpDBfSrE5uZxc8/lT7SoNP06OjWcCDUiWBwrkv:l+r47506OnCDTE

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\drivers\kiss.she	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SkinH_EL.dll	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5032	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 5032	4972	rundll32.exe	83
PID 4972 wrote to memory of 5032	4972	rundll32.exe	83
PID 4972 wrote to memory of 5032	4972	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5aa25c0ff26479b0662e7e6b413695e776d351098db82f6b80f3606e6c6bdf1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5aa25c0ff26479b0662e7e6b413695e776d351098db82f6b80f3606e6c6bdf1.dll,#1
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:5032

memory/5032-132-0x0000000000000000-mapping.dmp

Download
memory/5032-133-0x0000000010000000-0x00000000102E0000-memory.dmp

Filesize
2.9MB

Download
memory/5032-134-0x0000000010000000-0x00000000102E0000-memory.dmp

Filesize
2.9MB

Download