a1cca660d75186ff8cf3b43746a333aecc3a34f9581ba2ac52b772f44cd41390

Analysis

max time kernel
136s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 10:30

Target

a1cca660d75186ff8cf3b43746a333aecc3a34f9581ba2ac52b772f44cd41390.dll
Size

314KB
MD5

bd49700df54c3d8d1ae13d41c1d56e13
SHA1

da525bc1f6d8748bcf6c660fa04659b22545bc06
SHA256

a1cca660d75186ff8cf3b43746a333aecc3a34f9581ba2ac52b772f44cd41390
SHA512

e52a9e6bf181089f16d334ef6196b8b138106078c8798ed59e4ba013a0059f6cb61fae818895ca70049e427c0f87d050f46cbe10998ec3d71e8072937d065969
SSDEEP

6144:bYhYN9Lxf/xPavDUACjY7Vq+VKG9c3vTfyXN2SSf0vNz76JO1FZl/vJ:bYGb/xPav37Fwrfy9TeCFb3J

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3664	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3664	2876	rundll32.exe	80
PID 2876 wrote to memory of 3664	2876	rundll32.exe	80
PID 2876 wrote to memory of 3664	2876	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1cca660d75186ff8cf3b43746a333aecc3a34f9581ba2ac52b772f44cd41390.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1cca660d75186ff8cf3b43746a333aecc3a34f9581ba2ac52b772f44cd41390.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3664

memory/3664-133-0x0000000000750000-0x0000000000755000-memory.dmp

Filesize
20KB

Download
memory/3664-134-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download