41a9207db41c21c871109514d45a846b00afedbf82e0f31e989460bfe20a1c81

Analysis

max time kernel
109s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:09

Target

41a9207db41c21c871109514d45a846b00afedbf82e0f31e989460bfe20a1c81.dll
Size

514KB
MD5

782cf7183735935f3f7aad041cec3184
SHA1

8dc37621634afef87b889ebdbfce09bbc7238668
SHA256

41a9207db41c21c871109514d45a846b00afedbf82e0f31e989460bfe20a1c81
SHA512

a6816c70f570ee32d57c3111eb7882a25df78d19df719397562c30c0c4a14bd3d09082977f49f6aca8e6b19ff802950d1d81a530be72fb15135e46c64b7bda3f
SSDEEP

6144:xlWM+IJZrBkWSN2XkDNxaE3/JzMsUe9w0ExM01ttmO:/AI7JtmaEqveODM01t7

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

1312 rundll32.exe

pid	process
1312	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4252 wrote to memory of 1312	4252	rundll32.exe	rundll32.exe
PID 4252 wrote to memory of 1312	4252	rundll32.exe	rundll32.exe
PID 4252 wrote to memory of 1312	4252	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41a9207db41c21c871109514d45a846b00afedbf82e0f31e989460bfe20a1c81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4252

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41a9207db41c21c871109514d45a846b00afedbf82e0f31e989460bfe20a1c81.dll,#1
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1312