44bc90b5dc112476c338e2d91ce429405dfb066d20b4b2f62078adc8d6e82355

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 00:15

Target

44bc90b5dc112476c338e2d91ce429405dfb066d20b4b2f62078adc8d6e82355.dll
Size

68KB
MD5

cd9540f9a71f96c53a06a174890ef580
SHA1

2b3edddad866398adb277026cbf4ec1d5b3e8893
SHA256

44bc90b5dc112476c338e2d91ce429405dfb066d20b4b2f62078adc8d6e82355
SHA512

d4bcd03090ca0bfbf2ed665b1e9374e5a82375b9f714e8abf05821a3f47a4133df2480ba505cba36d64f97b0be8084f0e79759c3ca96e53042223445557ee380
SSDEEP

1536:+zfyf1OPhrNBboyp/j/9Ay6952QrAT36yoj/YmHJKoNJBZrzWvg:+zgO3ayhGr2jTqnjXHooNzdzt

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\latumovi.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sijuhidu	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5036	rundll32.exe
5036	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 5036	2816	rundll32.exe	76
PID 2816 wrote to memory of 5036	2816	rundll32.exe	76
PID 2816 wrote to memory of 5036	2816	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44bc90b5dc112476c338e2d91ce429405dfb066d20b4b2f62078adc8d6e82355.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44bc90b5dc112476c338e2d91ce429405dfb066d20b4b2f62078adc8d6e82355.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:5036

memory/5036-133-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/5036-134-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/5036-135-0x0000000000AB0000-0x0000000000B41000-memory.dmp

Filesize
580KB

Download
memory/5036-136-0x0000000000AB0000-0x0000000000B41000-memory.dmp

Filesize
580KB

Download