55f5e635cda9d4035a5cdbf858b5b568c76241150acce596457414a5f0a95b03

Analysis

max time kernel
102s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
10-02-2023 19:47

Target

55f5e635cda9d4035a5cdbf858b5b568c76241150acce596457414a5f0a95b03.dll
Size

401KB
MD5

b16ab069535e26e72729c8cc58cdd53f
SHA1

b71abab64b2714e20ac73b56c0f8bc907b61e740
SHA256

55f5e635cda9d4035a5cdbf858b5b568c76241150acce596457414a5f0a95b03
SHA512

e30b70fc11ef1d8d823fb0e1c0235d908fec1c2331beb8b3a85890d4d0266ae0288bf8244d7026a052d5424a522a81f6b655d05fd2feb0fd7c116acd9a74eb08
SSDEEP

6144:5k07oJEdZBAw9NWUojKsJXDJfKqgOi1GDhCU4be6LxNYb3MKnGvU9DC9WKJDV:XAwnWUojVNdsF1GcUYLxN4MaCRN

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

5076 rundll32.exe

pid	process
5076	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5060 wrote to memory of 5076	5060	rundll32.exe	rundll32.exe
PID 5060 wrote to memory of 5076	5060	rundll32.exe	rundll32.exe
PID 5060 wrote to memory of 5076	5060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55f5e635cda9d4035a5cdbf858b5b568c76241150acce596457414a5f0a95b03.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55f5e635cda9d4035a5cdbf858b5b568c76241150acce596457414a5f0a95b03.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:5076

memory/5076-132-0x0000000000000000-mapping.dmp

Download
memory/5076-133-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download
memory/5076-134-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download
memory/5076-135-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download