27784f24a8d0b693b96e57355c6eab3e56f2b6909cf74154393fdb6ee9ac6d17

Analysis

max time kernel
144s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 18:37

Target

冰封免费版(请关闭杀毒软件下载)/sky.dll
Size

2.3MB
MD5

4b3997a17c3c356b3c4a964059312ad3
SHA1

6b14988e49a58f48ced59248a41c17c9d6e1c3ef
SHA256

f06dfce697f6caabdd47e5acecd6a116f3fd9e238b2dc2f382077937e194aa7d
SHA512

7105816d6083681cdef6151fce90df2a6b922b5f32a65583006e7f2d3040d6c656e7e0b9d1274c8a5179d353d080fdbf44fb53688d645d71790bb86454d00908
SSDEEP

24576:QkwBweg/qAPbCGbB6NjGdcfibb9ee2Kw29v1oG36MJhBRBmhD9DVdNv6VzGaI+Hv:IMxUO5Ropdl+L4YexzxXG9

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1152 rundll32.exe

pid	process
1152	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2808 wrote to memory of 1152	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 1152	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 1152	2808	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\sky.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\sky.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1152