abccd3a8cb58f9d1c2ec92c74a6718ad38c1f78b78aa7872cd161d519a45464d

Analysis

max time kernel
61s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 23:31

Target

abccd3a8cb58f9d1c2ec92c74a6718ad38c1f78b78aa7872cd161d519a45464d.dll
Size

65KB
MD5

6df21314c785440e20e3e0bf931e9db0
SHA1

ebf9946c8d1032f31abce8095fada315bdc5f53f
SHA256

abccd3a8cb58f9d1c2ec92c74a6718ad38c1f78b78aa7872cd161d519a45464d
SHA512

1a0c985e846e1fc1d0ce9579f702fbb4752119577426debc26dff348eb046a5c7ef93aebe08aa2bfdee714d4b2157d10cf2fcaee670343489b807de5240564bc
SSDEEP

1536:MqDlpfQmWM1qqAuIaWModm17Icwa0STVHGDMk1ssGhBW8G:nDmMgqAuDWddhaRu9whZ

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sivinadu.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\fojibiya	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2976	rundll32.exe
2976	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2976	2960	rundll32.exe	80
PID 2960 wrote to memory of 2976	2960	rundll32.exe	80
PID 2960 wrote to memory of 2976	2960	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\abccd3a8cb58f9d1c2ec92c74a6718ad38c1f78b78aa7872cd161d519a45464d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\abccd3a8cb58f9d1c2ec92c74a6718ad38c1f78b78aa7872cd161d519a45464d.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:2976

memory/2976-133-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2976-134-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2976-135-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2976-136-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download