631b5c6078567ed90acf4b0a7aa46ff5e19de848e5848d016bf3dd272667ef72

Analysis

max time kernel
133s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 05:44

Target

631b5c6078567ed90acf4b0a7aa46ff5e19de848e5848d016bf3dd272667ef72.dll
Size

49KB
MD5

978466e48212b98dfb6d449d9bc738c0
SHA1

3905af99f3c17abc0023513265921d47bff02a87
SHA256

631b5c6078567ed90acf4b0a7aa46ff5e19de848e5848d016bf3dd272667ef72
SHA512

56a614d41ebd3383aea15100c571d5920c3d483009716e2471a21f01e71645e5e24dc6b3618b36c25e7bf6a274b5285916f607eb9acba2c4105a758e1f8b3342
SSDEEP

1536:Q27vSi0iu1WIeaJ65vX6Q850ZiV9W0H+Tis:Q2W03Iea4aciV9zHg

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4844	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 4844	848	rundll32.exe	82
PID 848 wrote to memory of 4844	848	rundll32.exe	82
PID 848 wrote to memory of 4844	848	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\631b5c6078567ed90acf4b0a7aa46ff5e19de848e5848d016bf3dd272667ef72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\631b5c6078567ed90acf4b0a7aa46ff5e19de848e5848d016bf3dd272667ef72.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4844

memory/4844-133-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/4844-134-0x0000000000E80000-0x0000000000E85000-memory.dmp

Filesize
20KB

Download
memory/4844-135-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download