de1097a9c56fc701dadbd7d5761535120e69128b3175ac51766ec228c52ecc55

Analysis

max time kernel
205s
max time network
229s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:46

Target

de1097a9c56fc701dadbd7d5761535120e69128b3175ac51766ec228c52ecc55.dll
Size

1.2MB
MD5

5334bd4917e0109b84fd6aa0f833d736
SHA1

e5c884ce82302b26f3043ae99e2b8bdd6faff455
SHA256

de1097a9c56fc701dadbd7d5761535120e69128b3175ac51766ec228c52ecc55
SHA512

d9fdf61c3de543ad9d5520d1aadec499446cb73e7456f766df0fd56f7781f8d4675f9244014e465ed0d3fe58bf751d177ce8477f8c56bac0d31a5c870cbc2e28
SSDEEP

24576:7H61XOiVWDAowhmMWpyy1Gmzb5/pVJcSwu+o+5TeqvlX:7H61eoUsyDVJcZTeqv

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\sjwcore.tmp rundll32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

rundll32.exe

pid process

3448 rundll32.exe
3448 rundll32.exe
3448 rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\sjwcore.tmp	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1156 wrote to memory of 3448	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 3448	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 3448	1156	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de1097a9c56fc701dadbd7d5761535120e69128b3175ac51766ec228c52ecc55.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156

memory/3448-132-0x0000000000000000-mapping.dmp

Download
memory/3448-133-0x0000000000890000-0x00000000009C5000-memory.dmp

Filesize
1.2MB

Download