fcbf588da9e106fcfe3e5feacc703a731fb3b601d62883cb70c0a9d912cdd245

Analysis

max time kernel
168s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 11:07

Target

fcbf588da9e106fcfe3e5feacc703a731fb3b601d62883cb70c0a9d912cdd245.dll
Size

82KB
MD5

78262250514fc01e9899326fb2e190e0
SHA1

04a4d35633c9514756e1e88e667b7f14db8efc50
SHA256

fcbf588da9e106fcfe3e5feacc703a731fb3b601d62883cb70c0a9d912cdd245
SHA512

de23c13185dc63a6e594e2fa8137b8c9cb8afd2cfae8efca880e3d44efc1b0a6374081ee076aafb99f590e7e97c01841ee508548ae07babc19eda201ebaa2d05
SSDEEP

1536:KGkqG5zIpP27FvUa/fkKUzHFAKPueT3Q9Mej8P5CaqE3yseJj:K+kRUa/f/UpAKP1TLejw5ByLh

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4072	rundll32.exe
4072	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 4072	868	rundll32.exe	79
PID 868 wrote to memory of 4072	868	rundll32.exe	79
PID 868 wrote to memory of 4072	868	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcbf588da9e106fcfe3e5feacc703a731fb3b601d62883cb70c0a9d912cdd245.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcbf588da9e106fcfe3e5feacc703a731fb3b601d62883cb70c0a9d912cdd245.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4072

memory/4072-133-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4072-134-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download