9fe4d10c44daacde9db63d2036670c60c21e481703a023cda2d69c2dc6a063a0

Analysis

max time kernel
162s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:32

Target

ٳ0.46/Hook.dll
Size

48KB
MD5

12ecdcc00f9b913cd34438439312a4ea
SHA1

c2fade5396cb7d42d6f43d2e4636ad5bdc23819b
SHA256

0bbbe8de878a509f694e8a84a64ff1c87aaa39a077b45ae320f6ba2ee0a06f11
SHA512

5ae43836263e05b08443a1ca1b5ae49ade392428aab1d3402d8f7e20361e34fe3e28244f87815961ee5c176c1494f22b151b44a8026af677a0b5c2ef79ffe48d
SSDEEP

384:qfponPyTxnmXgmtElrEDdsqX7bKEY0sDl3uey6SNTyuqM+cA+8oNcF1hB:jKTxnmX1NdsqXHKpN74NTyf+8oQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5076 wrote to memory of 4248	5076	rundll32.exe	rundll32.exe
PID 5076 wrote to memory of 4248	5076	rundll32.exe	rundll32.exe
PID 5076 wrote to memory of 4248	5076	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ٳ0.46\Hook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5076

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ٳ0.46\Hook.dll,#1
2⤵
PID:4248