b023958ed752e40590de355d449973b4586f9b62c224607b07881b1f4a35e059

Analysis

max time kernel
122s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 06:52

Target

b023958ed752e40590de355d449973b4586f9b62c224607b07881b1f4a35e059.dll
Size

105KB
MD5

1704c6479a9f40f62c87565a809024bf
SHA1

940ced57e4b244db9dc3b310fc5b996dcbaef1f3
SHA256

b023958ed752e40590de355d449973b4586f9b62c224607b07881b1f4a35e059
SHA512

02ccaada668bd1f72b1b4608fdb300da75a74dd5627fcb4eb6e00285f4bddd8f0f5d5954159fe331046b733bcd3845c5c80eb12162348c80d5a34ca3252a5a40
SSDEEP

3072:krX3kmXCYddHZZ664h+coBKpV8YeWgr3eu:kzciNa64h+N4VIWK31

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5016	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 5016	5052	rundll32.exe	82
PID 5052 wrote to memory of 5016	5052	rundll32.exe	82
PID 5052 wrote to memory of 5016	5052	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b023958ed752e40590de355d449973b4586f9b62c224607b07881b1f4a35e059.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b023958ed752e40590de355d449973b4586f9b62c224607b07881b1f4a35e059.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5016

memory/5016-132-0x0000000000000000-mapping.dmp

Download
memory/5016-133-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/5016-134-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/5016-135-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/5016-136-0x0000000002810000-0x0000000002929000-memory.dmp

Filesize
1.1MB

Download
memory/5016-137-0x0000000002810000-0x0000000002929000-memory.dmp

Filesize
1.1MB

Download