5dc88af9c4118b2b613ebf85a31ebfad89438c4c5e5c9d3a9f6f90fc1b33eef0

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 21:52

Target

5dc88af9c4118b2b613ebf85a31ebfad89438c4c5e5c9d3a9f6f90fc1b33eef0.dll
Size

83KB
MD5

ada6ecca32a3984f515aeb34884ef7e2
SHA1

22fcd3d5da2bdff5cb5eabe43ff632f23f54a816
SHA256

5dc88af9c4118b2b613ebf85a31ebfad89438c4c5e5c9d3a9f6f90fc1b33eef0
SHA512

80cf52713efae47cc694f7edbc0addea54e6a3b8d598a0e57012c8682bbca16a91daf75295ffd6027afa501f444b91abe56cb66205a9219a6741e16054d3f6cb
SSDEEP

1536:jNknanWXXq7ouDbpIlnVDCXHmJCk+/Natj+O9xhCZQW9twC/iORWPzkT2h:JkDobmV2XGMk+1atjj9xQt1RW7N

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1496	rundll32.exe
1496	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1496	1500	rundll32.exe	78
PID 1500 wrote to memory of 1496	1500	rundll32.exe	78
PID 1500 wrote to memory of 1496	1500	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5dc88af9c4118b2b613ebf85a31ebfad89438c4c5e5c9d3a9f6f90fc1b33eef0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5dc88af9c4118b2b613ebf85a31ebfad89438c4c5e5c9d3a9f6f90fc1b33eef0.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1496

memory/1496-133-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1496-134-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download