ea5c9b5d0f6dd7bddd595bd6bfda7d48fe13656bf4a72f5ecfbd38cdd80cd9fb

Analysis

max time kernel
234s
max time network
249s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 20:38

Target

HOOK.dll
Size

58KB
MD5

7e6be94c4023d1560f3678db2579b41f
SHA1

b4b5fa3fbf074a6da92afbb8d2bc632683ca74ec
SHA256

77c2ad1ebd183d1d94b68def677fd0691a4a6869f521294ff7619fcfe5fa5fbb
SHA512

3eaa31f8b25d45ac62637c93a160d90ea49b9487c65d88c94cfd29b6cafed3375ffcc22a459c173792f30639b8cad7da70a9044a4ab959c3ace56853aec35a8e
SSDEEP

768:PV1qkEM1uCxCrOMCMZWw3ZNZNYTdj8mNa2IJrmmSWmkvTSnno4KMpQQu8snP/SVJ:d1qkE+CjfNZN4dj8XxOuMbu73SVXpZZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 4140	908	rundll32.exe	81
PID 908 wrote to memory of 4140	908	rundll32.exe	81
PID 908 wrote to memory of 4140	908	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HOOK.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HOOK.dll,#1
  2⤵
  PID:4140