b4a61c8d752debdedc8f2719b42a7d1d201aa095a51f9c4d14c79ed80233e600

Analysis

max time kernel
111s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 08:21

Target

b4a61c8d752debdedc8f2719b42a7d1d201aa095a51f9c4d14c79ed80233e600.dll
Size

318KB
MD5

49a049a7a084c79665de493d78a3cb8c
SHA1

eb38ea5bff4f87b8d9684681cdc78e4389d7dfd6
SHA256

b4a61c8d752debdedc8f2719b42a7d1d201aa095a51f9c4d14c79ed80233e600
SHA512

8cecf8a34b4b97bcd0b3035d7de62d2219c47876ad1e9e32a52e504bf75f18f704cdbd2403a358894fe9ab957477f2e8517569bc13e52e73ec413f50106a6b94
SSDEEP

6144:NcEU6QCGaFLdndWSZFXDMAgkKXwt8HcyIYdBJ0kI+pHF5NNyEfqvPDmFx2HOoDfQ:9vXPZPZpMHipyI+5ZHvEXo2u44

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4884	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 4884	1608	rundll32.exe	81
PID 1608 wrote to memory of 4884	1608	rundll32.exe	81
PID 1608 wrote to memory of 4884	1608	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4a61c8d752debdedc8f2719b42a7d1d201aa095a51f9c4d14c79ed80233e600.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4a61c8d752debdedc8f2719b42a7d1d201aa095a51f9c4d14c79ed80233e600.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4884

memory/4884-133-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download
memory/4884-134-0x00000000009B0000-0x00000000009B6000-memory.dmp

Filesize
24KB

Download