1d1d05b3493d9f3b6cc4d55c4ba5397c9d7681a716d45337203f58bbfaa09839

Analysis

max time kernel
185s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:44

Target

1d1d05b3493d9f3b6cc4d55c4ba5397c9d7681a716d45337203f58bbfaa09839.dll
Size

2.1MB
MD5

ae6db3a4cfb57819eb398b79c9042565
SHA1

9d7d5822c2ee5599ea34d1b86ac5c18d3b3575a9
SHA256

1d1d05b3493d9f3b6cc4d55c4ba5397c9d7681a716d45337203f58bbfaa09839
SHA512

30130add70fac71b42ac92ae4d67b5c77ac1c22992ba39d267e68c3a521014b18eba0f6974656e51793f6ab9f90aed9dba2f05c88f360d17cdb6de0f629f6d90
SSDEEP

24576:cJx20Ax1WR15UW6vcoN/EEiri/wd0wzdHOQIIXUFMkcPLOmRxzNpMHjHdMH6w:czldiW63PiTdLzdHxI5ByzNaHjHMn

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

3256 rundll32.exe

pid	process
3256	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 220 wrote to memory of 3256	220	rundll32.exe	rundll32.exe
PID 220 wrote to memory of 3256	220	rundll32.exe	rundll32.exe
PID 220 wrote to memory of 3256	220	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d1d05b3493d9f3b6cc4d55c4ba5397c9d7681a716d45337203f58bbfaa09839.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d1d05b3493d9f3b6cc4d55c4ba5397c9d7681a716d45337203f58bbfaa09839.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:3256