0d1aad1dd6c22b12c1c1a62f13d1056efafa42d841eb72664ea396b005975286

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2023, 18:44

Target

0d1aad1dd6c22b12c1c1a62f13d1056efafa42d841eb72664ea396b005975286.dll
Size

1.1MB
MD5

d213690862dc268cb6e0f05894feded5
SHA1

099c057686d5ede0a74b9e23f75cbabac30b9030
SHA256

0d1aad1dd6c22b12c1c1a62f13d1056efafa42d841eb72664ea396b005975286
SHA512

ff3f18af4135e33d3188b71b909072608fda54b5a30eadcf3c686dbeb744ac157839d9d7acaa1f45b971601c4f793b6ce7c7eb00994d113789a93c96842fdf66
SSDEEP

24576:cPnMf4AH5mIpVb7k3BcPVaivNGkKcznKbK63LD:cfIpV6BctbNGkbznz0D

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3608	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 3608	4752	rundll32.exe	81
PID 4752 wrote to memory of 3608	4752	rundll32.exe	81
PID 4752 wrote to memory of 3608	4752	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d1aad1dd6c22b12c1c1a62f13d1056efafa42d841eb72664ea396b005975286.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d1aad1dd6c22b12c1c1a62f13d1056efafa42d841eb72664ea396b005975286.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3608