42298da6fa04cdab7a36d16ca6e1c48b373c1faa8cdc5a206be3ddc402463f2a

Analysis

max time kernel
88s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/12/2022, 19:09

Target

42298da6fa04cdab7a36d16ca6e1c48b373c1faa8cdc5a206be3ddc402463f2a.dll
Size

864KB
MD5

a7fc8c963692c06b10f4b80c6b1e6c96
SHA1

32c3dbd3610399dd0a9583c78cf1adf3faca43d4
SHA256

42298da6fa04cdab7a36d16ca6e1c48b373c1faa8cdc5a206be3ddc402463f2a
SHA512

7520a01b1534085d1330e38de1000445187876772f30b293da03efdd3df39ae62a3a7507ad23cff1767ef7499328fa225522ca12c2716b70db129a345fb2d915
SSDEEP

6144:ctsk41kXaGMOBHBmavA2Ugl8muDTuY40ocVWfGAvKAoowJ5sP3qEJDlEvnYOmMxn:yto1u0avA21uJATvY1JOVYYOLxl1

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4304	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4304	4976	rundll32.exe	82
PID 4976 wrote to memory of 4304	4976	rundll32.exe	82
PID 4976 wrote to memory of 4304	4976	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42298da6fa04cdab7a36d16ca6e1c48b373c1faa8cdc5a206be3ddc402463f2a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42298da6fa04cdab7a36d16ca6e1c48b373c1faa8cdc5a206be3ddc402463f2a.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4304