f3f458930c977a82ab87c36251c6870c7486425056968488f85d4490e6c98d0b

Analysis

max time kernel
111s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 05:53

Target

f3f458930c977a82ab87c36251c6870c7486425056968488f85d4490e6c98d0b.dll
Size

960KB
MD5

1690c839d09d26b70d8c42e7e91f54c0
SHA1

8ed0fe1275e0f39fc4b9a8c1e61c49c226b63925
SHA256

f3f458930c977a82ab87c36251c6870c7486425056968488f85d4490e6c98d0b
SHA512

79a92f3c3ac9a82e8642786e9f0fd84139a25035e81ed91be745ed42b4d9fddff00ad27a0cbd54184419fc049940e289108ec7f19991425c276bb497f7c7daa4
SSDEEP

24576:wXsDPQwHO89HRnNa/QMMUtOjWcCDUiWBwrk9:N4w953y/OnCDTm

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\drivers\kiss.she	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SkinH_EL.dll	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1656	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 1656	3260	rundll32.exe	79
PID 3260 wrote to memory of 1656	3260	rundll32.exe	79
PID 3260 wrote to memory of 1656	3260	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3f458930c977a82ab87c36251c6870c7486425056968488f85d4490e6c98d0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3f458930c977a82ab87c36251c6870c7486425056968488f85d4490e6c98d0b.dll,#1
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:1656

memory/1656-133-0x0000000010000000-0x00000000102BC000-memory.dmp

Filesize
2.7MB

Download
memory/1656-134-0x0000000010000000-0x00000000102BC000-memory.dmp

Filesize
2.7MB

Download