afe15eefbe1be89ac82a8cdc89cda50cf792d476d2fa653a3fda25f049fd1c94

Analysis

max time kernel
90s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 08:54

Target

afe15eefbe1be89ac82a8cdc89cda50cf792d476d2fa653a3fda25f049fd1c94.dll
Size

56KB
MD5

416a18f40bf55b4642fad75c4c165ddf
SHA1

16f08401e27e170949e5f8edd1a7fc01c5f8fc08
SHA256

afe15eefbe1be89ac82a8cdc89cda50cf792d476d2fa653a3fda25f049fd1c94
SHA512

223fe46b5e71373a0b18bf257ecc586cbb7dd6df8193fc17e69a006abc34b0f998c2e6664efe9d1fdb775b994be47c040c4af4cd5c53a2266325ff2af23c1675
SSDEEP

768:qQJvznJcPRIjFkcENDgeHtY5pc/76paw7Fzwz+RriT:qSvznuPRIjFqacep97VGWr2

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4572	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4572	4956	rundll32.exe	20
PID 4956 wrote to memory of 4572	4956	rundll32.exe	20
PID 4956 wrote to memory of 4572	4956	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\afe15eefbe1be89ac82a8cdc89cda50cf792d476d2fa653a3fda25f049fd1c94.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\afe15eefbe1be89ac82a8cdc89cda50cf792d476d2fa653a3fda25f049fd1c94.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4572