cfe53109c58cfb593cf8864dc9e5b50dfb269c7d986af7ff7c356a844a3036f9

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2023 19:27

Target

cfe53109c58cfb593cf8864dc9e5b50dfb269c7d986af7ff7c356a844a3036f9.dll
Size

419KB
MD5

d644f4c6e336234d358cb4171cab4fab
SHA1

93def80398c6c69089d84225c253f323ca6d120e
SHA256

cfe53109c58cfb593cf8864dc9e5b50dfb269c7d986af7ff7c356a844a3036f9
SHA512

6c8ee543a1d29f88f17c4ea70592f25131122e1c4ca21aa48fab1982bb8766e04f77a5c797368ec7be5c7e30d1b05cd8dbc4671af7b0abcd488962dbb1c9659d
SSDEEP

12288:tG3Z4xjHybY0uLJRA/1R39DFSJud2aXjyQY:tGp6jHgG3aVBQudFfY

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

2700 rundll32.exe

pid	process
2700	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2876 wrote to memory of 2700	2876	rundll32.exe	rundll32.exe
PID 2876 wrote to memory of 2700	2876	rundll32.exe	rundll32.exe
PID 2876 wrote to memory of 2700	2876	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfe53109c58cfb593cf8864dc9e5b50dfb269c7d986af7ff7c356a844a3036f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfe53109c58cfb593cf8864dc9e5b50dfb269c7d986af7ff7c356a844a3036f9.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:2700

memory/2700-132-0x0000000000000000-mapping.dmp

Download
memory/2700-133-0x0000000010000000-0x0000000010109000-memory.dmp

Filesize
1.0MB

Download
memory/2700-135-0x0000000010000000-0x0000000010109000-memory.dmp

Filesize
1.0MB

Download
memory/2700-136-0x0000000010000000-0x0000000010109000-memory.dmp

Filesize
1.0MB

Download
memory/2700-137-0x0000000010000000-0x0000000010109000-memory.dmp

Filesize
1.0MB

Download