d573bfc4f8016b5762aac81d5ea2c1fbcd402d70139482fc9b3e19daf3800e03

Analysis

max time kernel
93s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2023 18:59

Target

d573bfc4f8016b5762aac81d5ea2c1fbcd402d70139482fc9b3e19daf3800e03.dll
Size

1.4MB
MD5

19e6817b2fa1bae0e9e7cca721549835
SHA1

91b66dd16e72111b478767ae0e5837988f50166b
SHA256

d573bfc4f8016b5762aac81d5ea2c1fbcd402d70139482fc9b3e19daf3800e03
SHA512

998adf86dd8380b8fc3daf28328e369e06fbeb30ecdc91650880d01549c971e3cf4613e5806345672c3acd59376e65e63437f201a8bd70b17013d2a6e24c3f32
SSDEEP

24576:EWaBswTAEoKwlTD82CJy4VInpmVCfixrWxITZHCALkl4Njkiu2XOx2jo7dmPtzPD:+BsUAEvw435VInksQoIdHCkdG2X1oJCc

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

12 3100 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

3100 rundll32.exe

flow	pid	process
12	3100	rundll32.exe

pid	process
3100	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1572 wrote to memory of 3100	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 3100	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 3100	1572	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d573bfc4f8016b5762aac81d5ea2c1fbcd402d70139482fc9b3e19daf3800e03.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1572

memory/3100-133-0x0000000010000000-0x00000000103C5000-memory.dmp

Filesize
3.8MB

Download
memory/3100-134-0x0000000001580000-0x0000000001583000-memory.dmp

Filesize
12KB

Download