a74f97059acbd38c8f0ebb92e23f1f4e04d4ce53ffdeb43b154486f3758445a0

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 22:23

Target

a74f97059acbd38c8f0ebb92e23f1f4e04d4ce53ffdeb43b154486f3758445a0.dll
Size

64KB
MD5

9cf1b96d7cc831e9c7b5e6bb6c953c1f
SHA1

e5dd4764298e6ca5a946925bd5c7b8513d09ed80
SHA256

a74f97059acbd38c8f0ebb92e23f1f4e04d4ce53ffdeb43b154486f3758445a0
SHA512

c39cfcc24777ec9d699beea2d844f81b234f8fcfd077ac8592a4c6a0877594e34355cac15db283c674efe052e7bc543a5804fb9f78977ffd5523de68ce8f13b0
SSDEEP

1536:MSkwSiDNTj1fdNFmm31nK9S0w7z1yF9+RxROi0X:yxixTRfdNQS0Sz1ySRxROi0

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1748	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 1748	1868	rundll32.exe	80
PID 1868 wrote to memory of 1748	1868	rundll32.exe	80
PID 1868 wrote to memory of 1748	1868	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a74f97059acbd38c8f0ebb92e23f1f4e04d4ce53ffdeb43b154486f3758445a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a74f97059acbd38c8f0ebb92e23f1f4e04d4ce53ffdeb43b154486f3758445a0.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1748