e60400f9da142b7bb4e83bfa2d964e3ed937dd350d2c6881c21daa826757bac3

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
18/12/2022, 20:31

Target
SecuriteInfo.com.Win32.Evo-gen.26930.13860.dll
Size 732KB
Sample221218-zapseagf71
SHA256 e60400f9da142b7bb4e83bfa2d964e3ed937dd350d2c6881c21daa826757bac3
MD5 67b66d389eef5e61d46e14afccf978db
SHA1 18449b4d78265f2cd5510102bd72e616d2d37f23
SHA512 1c5aa582952667adb1acaeb24f27707d3a13990dc45731389aa9206ec5d78d8fb68822cc9192e11a6e2a369dd741ee09b40d9f278ca72481c3c5afb8f93122a7
SSDEEP 6144:na5MhNqhWf+Yl2l2Ly1wIYUzKxWWd0d4MuM2KfhK7gk0wzeBiUlzBeN+aYkyLVSP:na5MhNaWfBqcIWqim7s7Hc/p2QLVy
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4960	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 4960	4284	rundll32.exe	81
PID 4284 wrote to memory of 4960	4284	rundll32.exe	81
PID 4284 wrote to memory of 4960	4284	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.26930.13860.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.26930.13860.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4960