dbb8f306bbb7903c13600dfb81830c9515cc958443f440165b3862066d920117

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 06:51

Target

dbb8f306bbb7903c13600dfb81830c9515cc958443f440165b3862066d920117.dll
Size

70KB
MD5

532211620d0320af270af8bd95a3e842
SHA1

f68c1bbc0963133fa715cf3ba72eb546823ba37f
SHA256

dbb8f306bbb7903c13600dfb81830c9515cc958443f440165b3862066d920117
SHA512

239f1a1f4df3c5447ece1560834a176fd85aa6a4859bdeee8798249644840f003db76b30608fc56629f26de65be6377ca68ba2d27ea0b7193f2ada86e4a753cb
SSDEEP

1536:pRlbsrY1bvynjnacr4S8plyB8LGLB6WCSeopkTE7IU6:9bsrSbazaRS8pE8LGLDC1oGTE7IR

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\tajukifo.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\kasiyeho	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4880	rundll32.exe
4880	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4880	4984	rundll32.exe	81
PID 4984 wrote to memory of 4880	4984	rundll32.exe	81
PID 4984 wrote to memory of 4880	4984	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbb8f306bbb7903c13600dfb81830c9515cc958443f440165b3862066d920117.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbb8f306bbb7903c13600dfb81830c9515cc958443f440165b3862066d920117.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:4880

memory/4880-133-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4880-134-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4880-135-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4880-136-0x0000000002BF0000-0x0000000002C79000-memory.dmp

Filesize
548KB

Download