6dbeebffd9de2d1c6c10c7d2bbc221dccf92b8ee4a203f5761d1343e34436a61

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 09:45

Target

츨11.27ɫ/츨11.27.dll
Size

1.4MB
MD5

5292dd08cc360231e91320d2599c5c8a
SHA1

caf0bd247c4c4d73854ba6c852ee97ce46cf4949
SHA256

0d08a63a51270608424655e58669b4e843062a18e8eb97b232401ff3bd3510c9
SHA512

ce86e3433d5857981419cf46b8bceae63570406938397acfc8f845eca99e89c654ec4d973a89b0d11a9c39ee1d9ebb5dbc33f906c89207970760c4223a781077
SSDEEP

24576:/3//MJCTzF2S9rfY3Lxn8EacxRabl+dbl3rw3nk6aju8Yovco4Jc2af:/3bF2S9rfY3Lx1XRSl+/E3Ku8Yov4Raf

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

5028 rundll32.exe

pid	process
5028	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4956 wrote to memory of 5028	4956	rundll32.exe	rundll32.exe
PID 4956 wrote to memory of 5028	4956	rundll32.exe	rundll32.exe
PID 4956 wrote to memory of 5028	4956	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5028