a3c0a95c9761166190166e364d872dbc2f40c671fb9042ec1edb183b0b571667

Analysis

max time kernel
162s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 02:53

Target

a3c0a95c9761166190166e364d872dbc2f40c671fb9042ec1edb183b0b571667.dll
Size

296KB
MD5

cc9a76599b9ee61a1fa071ac15986702
SHA1

dc67b2f072f21f24ae021fc3cbb164402665f44e
SHA256

a3c0a95c9761166190166e364d872dbc2f40c671fb9042ec1edb183b0b571667
SHA512

fa998596363c63a050133537a819859d7477cb132b1beb12c16fa84e8d7a3e452cd62774af42ca1fe843c0968c7641112e1c68e3bd30502a21077c3c3bf01bec
SSDEEP

6144:IsnLinTjCUcpznXOt+bZD0ZR1qEKMGfOkrcmHjHb:DLinfCU4nHGnbXGfOkrH7b

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1660	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 1660	4724	rundll32.exe	85
PID 4724 wrote to memory of 1660	4724	rundll32.exe	85
PID 4724 wrote to memory of 1660	4724	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3c0a95c9761166190166e364d872dbc2f40c671fb9042ec1edb183b0b571667.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3c0a95c9761166190166e364d872dbc2f40c671fb9042ec1edb183b0b571667.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1660

memory/1660-133-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download
memory/1660-134-0x0000000000DE0000-0x0000000000DE5000-memory.dmp

Filesize
20KB

Download
memory/1660-135-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download