2bc78b2cb385b002ee7cf3406e93c7ee336765022f9c3298637dc6496d8fc2fe

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 19:17

Target

츨12.16ɫ/츨12.16.dll
Size

2.3MB
MD5

a34666912e7b02f977add5ba14ae6d63
SHA1

fa2b1c9b6a4cef002c5c313d0baba5249e7a3b38
SHA256

bf2f6c8572dd7e27fda731179f618ef4e14a80c02d0472d00cac4ffae99f4a0d
SHA512

1a18e36fb1671cbb839b19a108d20c8bd32ad2397f2a53a417c098e3b79e74b11ef39f5b8abbdda82974e6c6aa4f2f6f37741114653e6a91b99eabe18c58aec4
SSDEEP

24576:Vmf/XdhToOiUOiqijjpGbZVNIpiJJ5Ee/Mr+haYVQO6JmnwOYNZJZy9Xh//gM1gb:aaRHWd6KKUA4MrVD+L4YmMu1ALn

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1984 rundll32.exe

pid	process
1984	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1612 wrote to memory of 1984	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 1984	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 1984	1612	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:1984