f9f66f248bcd715e6643b6353ff77ecac8d48abc8cc9877c3ae015bf93c03e31

Analysis

max time kernel
258s
max time network
282s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 10:47

Target
f9f66f248bcd715e6643b6353ff77ecac8d48abc8cc9877c3ae015bf93c03e31.dll
Size 79KB
Sample221204-mvt7eabf52
SHA256 f9f66f248bcd715e6643b6353ff77ecac8d48abc8cc9877c3ae015bf93c03e31
MD5 de13d5e7a6670df6df3c398027f7f09a
SHA1 88dbba20d0bf9474b17e5bdaff0a447a5ca1b331
SHA512 135106bcc03b89b65eb445918c0a473a3db5f8124f1a6ae951a7ca40758844b834bd340b1802ba9864359d2d1951bf4618fa116104c1f9ae27cc2226baed8752
SSDEEP 1536:zsdQDHgGRVFhU/dants4jc10CkMfZ2tJyHQIohKg4ZY:od8HjMats4jm0ScawIXg
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2868	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2868	2288	rundll32.exe	82
PID 2288 wrote to memory of 2868	2288	rundll32.exe	82
PID 2288 wrote to memory of 2868	2288	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9f66f248bcd715e6643b6353ff77ecac8d48abc8cc9877c3ae015bf93c03e31.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9f66f248bcd715e6643b6353ff77ecac8d48abc8cc9877c3ae015bf93c03e31.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2868

memory/2868-133-0x0000000010000000-0x0000000010028000-memory.dmp

Download