fca0368e45dfb97bb4d472f3e24b72e0fd833bfc98144d759975bd5dbec94787

Analysis

max time kernel
87s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2023 18:39

Target

fca0368e45dfb97bb4d472f3e24b72e0fd833bfc98144d759975bd5dbec94787.dll
Size

1.4MB
MD5

996a4eff33c91fe76323f1d5a5ec4726
SHA1

555c59601dd694a0cfbca1f24284b7b1d41f2bbf
SHA256

fca0368e45dfb97bb4d472f3e24b72e0fd833bfc98144d759975bd5dbec94787
SHA512

4b1807ba9e516de025e5a298435149b96a07cbdb4ca3f1a1f80d501dbbad2e84be83e456c79289c784f3647f96cffa649549deaf7e26b25441c6bcb98e31dba0
SSDEEP

24576:Wb3rZGW4IXH8cUuMA2K0IO2SLh20xU4WWGBckJmnj1eTf4PX7Q1dXD3z0HCykDlf:WvZR79kok20xmWGB9mnRwgPEnz0iyaIc

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

16 2140 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

2140 rundll32.exe

flow	pid	process
16	2140	rundll32.exe

pid	process
2140	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1932 wrote to memory of 2140	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 2140	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 2140	1932	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fca0368e45dfb97bb4d472f3e24b72e0fd833bfc98144d759975bd5dbec94787.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932

memory/2140-133-0x0000000010000000-0x0000000010404000-memory.dmp

Filesize
4.0MB

Download
memory/2140-134-0x0000000000A80000-0x0000000000A83000-memory.dmp

Filesize
12KB

Download
memory/2140-135-0x0000000000A80000-0x0000000000A83000-memory.dmp

Filesize
12KB

Download