c0a7d285ff18706dc7cff7f0c1b8f3aa36119d6e054d245f9e2f83826f99afd8

Analysis

max time kernel
149s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 05:53

Target

c0a7d285ff18706dc7cff7f0c1b8f3aa36119d6e054d245f9e2f83826f99afd8.dll
Size

1.4MB
MD5

9fedbbc0aa8604a638fc45b490a984b3
SHA1

92166ca401ca017666786365f014fe4874c24e4a
SHA256

c0a7d285ff18706dc7cff7f0c1b8f3aa36119d6e054d245f9e2f83826f99afd8
SHA512

762731395c4e159cc97bbc4be7a72f195c0cdd3a502da43b89abffad539bc7adbea00a8a08fe79e799561fd93b5732bea3683af5f3f1579bd374b3be37b235a5
SSDEEP

24576:e/JsOQZ+MgWJkJyA8EesOY5aNkwLLFQA8v4fJLDGxBx1RPydef7sVi48/8:eGRVJH9Ns1EkOQAGYxOBx6AfQ2k

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4952	rundll32.exe
4952	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4952	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 4952	364	rundll32.exe	79
PID 364 wrote to memory of 4952	364	rundll32.exe	79
PID 364 wrote to memory of 4952	364	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0a7d285ff18706dc7cff7f0c1b8f3aa36119d6e054d245f9e2f83826f99afd8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0a7d285ff18706dc7cff7f0c1b8f3aa36119d6e054d245f9e2f83826f99afd8.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4952

memory/4952-132-0x0000000000000000-mapping.dmp

Download
memory/4952-133-0x0000000010000000-0x0000000010370000-memory.dmp

Filesize
3.4MB

Download
memory/4952-134-0x0000000010000000-0x0000000010370000-memory.dmp

Filesize
3.4MB

Download