03f38e3ad69d5a21584497c76793a676fd4bdd849bb76637e7bff52fe4a6158a

Analysis

max time kernel
135s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2023, 18:41

Target

03f38e3ad69d5a21584497c76793a676fd4bdd849bb76637e7bff52fe4a6158a.dll
Size

784KB
MD5

b0bd47ed272b103bc6df73baf0069a50
SHA1

f1203673ebf7484f244b2db2d6aedf0074ad5f26
SHA256

03f38e3ad69d5a21584497c76793a676fd4bdd849bb76637e7bff52fe4a6158a
SHA512

f11b438da7f3032be5035fbf347253f2049c89aa5ebcc449cf0d6f641a7771f6dcebe5722f4211567902202fc7e4d6a260e468d1dcbd9c5af8363c05898ec085
SSDEEP

12288:SenGDbOBwCIE4/3FP+rg2wu5DYpp8cfJ:SeGDbmwxEOwrdwaYpp8cfJ

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1564	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1564	2988	rundll32.exe	86
PID 2988 wrote to memory of 1564	2988	rundll32.exe	86
PID 2988 wrote to memory of 1564	2988	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03f38e3ad69d5a21584497c76793a676fd4bdd849bb76637e7bff52fe4a6158a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\03f38e3ad69d5a21584497c76793a676fd4bdd849bb76637e7bff52fe4a6158a.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1564