8c6a41f9557a58b0b4de66972853c357e515695f8a0cd53f1bcdb0cc2dff5b04

Analysis

max time kernel
125s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2023, 21:42

Target

8c6a41f9557a58b0b4de66972853c357e515695f8a0cd53f1bcdb0cc2dff5b04.dll
Size

2.1MB
MD5

7026b8f3cf07b74f8cf1d12c7b02a93c
SHA1

0d422fce7ce3abfc59d95ef97e83767d7ce0cc4c
SHA256

8c6a41f9557a58b0b4de66972853c357e515695f8a0cd53f1bcdb0cc2dff5b04
SHA512

32bec423d445a7b202b765da97d9eecc2c8f4cd06e7452f43fb4759c0293d8dbcafc529783ab59febb88261953cc9a028cbc867d465e12a346a32a4d6ce01cdd
SSDEEP

24576:cJx20Ax1WR15UW6vcoN/EEiri/wd0wzdHOQIIXUFMkcPLOmRxzNpMHjHDMH6w:czldiW63PiTdLzdHxI5ByzNaHjHCn

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4820	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 4820	3044	rundll32.exe	81
PID 3044 wrote to memory of 4820	3044	rundll32.exe	81
PID 3044 wrote to memory of 4820	3044	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c6a41f9557a58b0b4de66972853c357e515695f8a0cd53f1bcdb0cc2dff5b04.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c6a41f9557a58b0b4de66972853c357e515695f8a0cd53f1bcdb0cc2dff5b04.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4820