36b960e07be05f7ef8944516166099b98eceda66bf4f884d46761cb02700af00

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:52

Target

36b960e07be05f7ef8944516166099b98eceda66bf4f884d46761cb02700af00.dll
Size

56KB
MD5

b4e81df73b1f50be2211dffd7d36a15f
SHA1

27cacdc81cbe6d61182e153abbc30d3831c9c855
SHA256

36b960e07be05f7ef8944516166099b98eceda66bf4f884d46761cb02700af00
SHA512

21a13f95b492d042586ee4cdaad53d99624059a0c651ff231ea4b061ec60ba0dd14a53db91fc5b8b46cd1277f3fa822442863bec89fc5b9c342c6a699e312e15
SSDEEP

384:fP0P//K9Wsd+/kto2EDCSqgpPJPKj/JcCcgONER+WxgqClRgVA3RTJr4UgIeupOP:f8P/nsP/gGjyCENggqClRgAziZ1tVtx

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

3404 rundll32.exe

pid	process
3404	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2808 wrote to memory of 3404	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 3404	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 3404	2808	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36b960e07be05f7ef8944516166099b98eceda66bf4f884d46761cb02700af00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36b960e07be05f7ef8944516166099b98eceda66bf4f884d46761cb02700af00.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:3404