d9c55863291fed79b6d918305c59a6a7c54dd2614125c48b77b60c3473af92c8

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 14:42

Target

d9c55863291fed79b6d918305c59a6a7c54dd2614125c48b77b60c3473af92c8.dll
Size

49KB
MD5

8b0770e7f32ecd819b24da7c7d2ccb10
SHA1

57923f68e0852e6a0651a3320b6b1c4379a765af
SHA256

d9c55863291fed79b6d918305c59a6a7c54dd2614125c48b77b60c3473af92c8
SHA512

9f072de319d2854771cf8eb0e99e87658989d6bd08734efff3621126f7125fdf997418629f51305540886cab765f0b3a9cfc5a2b4ffd3c16143546f62146f2a3
SSDEEP

768:gfYuRnW2voC7K88CpT6C7bGr6kqKFfVBwlFDxlDTH/Fxgmza4G6l:K/4woCzzpT6Cn6xBwPDrHwmDG6l

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5044	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 5044	4032	rundll32.exe	82
PID 4032 wrote to memory of 5044	4032	rundll32.exe	82
PID 4032 wrote to memory of 5044	4032	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9c55863291fed79b6d918305c59a6a7c54dd2614125c48b77b60c3473af92c8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9c55863291fed79b6d918305c59a6a7c54dd2614125c48b77b60c3473af92c8.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5044

memory/5044-133-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/5044-134-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/5044-135-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download