c5d9fb6ede8163c89fd19ce117d617bb0f4a173af684266e2f24db0ac5acbef2

Analysis

max time kernel
150s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 06:24

Target

c5d9fb6ede8163c89fd19ce117d617bb0f4a173af684266e2f24db0ac5acbef2.dll
Size

314KB
MD5

ab659c28a947516eab073f7a2d8f8e87
SHA1

6c8e2bbe5f3f11daf8e96b5faa00a3381d6651cf
SHA256

c5d9fb6ede8163c89fd19ce117d617bb0f4a173af684266e2f24db0ac5acbef2
SHA512

1e8b0f7fce0e26cab1a2c1858846c320bd8384120ef2bbc50728c2d59af0245effc96360a6e75484487da997efd3c334bbb45bc699c2ed45a813a7cd76b336bc
SSDEEP

6144:HDvB4Fi3q/4E/3kWO6GwTqOjOpRbltLf7FY63t9OGHhozToe3nikwW6c:jmik4Ejpe1ltj7263tNicNW6c

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2748	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 2748	3336	rundll32.exe	80
PID 3336 wrote to memory of 2748	3336	rundll32.exe	80
PID 3336 wrote to memory of 2748	3336	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d9fb6ede8163c89fd19ce117d617bb0f4a173af684266e2f24db0ac5acbef2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d9fb6ede8163c89fd19ce117d617bb0f4a173af684266e2f24db0ac5acbef2.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2748

memory/2748-133-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download
memory/2748-134-0x00000000011E0000-0x00000000011E5000-memory.dmp

Filesize
20KB

Download