d142d5930df0432165de3dfbd753b381e1c49627c879cb638b728c90d9d34ef6

Analysis

max time kernel
151s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 16:18

Target

d142d5930df0432165de3dfbd753b381e1c49627c879cb638b728c90d9d34ef6.dll
Size

82KB
MD5

3d803815f7d6cb201892094374ba849b
SHA1

f8a4528b24ea7d609ff1225487c6413b9203560f
SHA256

d142d5930df0432165de3dfbd753b381e1c49627c879cb638b728c90d9d34ef6
SHA512

6d99e64579a08e280311287e0a2c7163faaf3f356ea333667bc8a4629128e502b1b6e19e3e3e9556dcc9cc96b50de888d13972d47742b5d73c2cf073663882a5
SSDEEP

1536:wzshlNTgeRUI+IrelION40dSunErtPaQPGc+R7ZCUxxb:wohl1g8UIzrelIUhJEnPM

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3664	rundll32.exe
3664	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3664	2876	rundll32.exe	78
PID 2876 wrote to memory of 3664	2876	rundll32.exe	78
PID 2876 wrote to memory of 3664	2876	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d142d5930df0432165de3dfbd753b381e1c49627c879cb638b728c90d9d34ef6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d142d5930df0432165de3dfbd753b381e1c49627c879cb638b728c90d9d34ef6.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3664

memory/3664-133-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3664-134-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download