f4cc47d7f817c4cf3ee8c10cf517dc1e9d6c5119b5442cd358cfda9ef5bdef07

Analysis

max time kernel
132s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 06:50

Target

f4cc47d7f817c4cf3ee8c10cf517dc1e9d6c5119b5442cd358cfda9ef5bdef07.dll
Size

67KB
MD5

79daf84ab7fe6eae468078701a495084
SHA1

45bbb29320e923e2206c462eeb59b02fab0eeb5f
SHA256

f4cc47d7f817c4cf3ee8c10cf517dc1e9d6c5119b5442cd358cfda9ef5bdef07
SHA512

8931adfad487135c80e7eafb574ecb9aa898d6f1bd551b3f13090e633991c9dd9086e98f953d1e6307e1347775874ccd822decde9ffee8fc6d2c80b9ab93f39c
SSDEEP

1536:hQTnnuBZ0saurkiFmB7VoYIzTL6w8xZXdMGVvj9NNO:hQTEMuoiFmB7Voz3OdhzLnQ

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\woseyime.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\pahataha	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1032	rundll32.exe
1032	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 1032	1360	rundll32.exe	84
PID 1360 wrote to memory of 1032	1360	rundll32.exe	84
PID 1360 wrote to memory of 1032	1360	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4cc47d7f817c4cf3ee8c10cf517dc1e9d6c5119b5442cd358cfda9ef5bdef07.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4cc47d7f817c4cf3ee8c10cf517dc1e9d6c5119b5442cd358cfda9ef5bdef07.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:1032

memory/1032-133-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1032-134-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1032-135-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1032-136-0x0000000002920000-0x00000000029B0000-memory.dmp

Filesize
576KB

Download