ec6fc79710a6f7dba4f298cad2a701623c4b17f5187744d8053ec300e95ea33d

Analysis

max time kernel
77s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2023 20:29

Target

ec6fc79710a6f7dba4f298cad2a701623c4b17f5187744d8053ec300e95ea33d.dll
Size

696KB
MD5

7d91d65dc7d3168e0e570000f5025e3c
SHA1

137af4138f5c9f81690b942e4ce1e0988dd63708
SHA256

ec6fc79710a6f7dba4f298cad2a701623c4b17f5187744d8053ec300e95ea33d
SHA512

764f84c8df1c97cc62f9ef0a9d53b9e9a1cd6989314108abcad57f7aab38f35eb913f6f573df4719d5575166a75cc1d6f5189f884847c4c136c34645efa12e21
SSDEEP

12288:Xi/JDpGQ3bPa7PPZmMoQUxEDbqEU86VY77:Xi/JtGQ3bEHQMLU4bqhrVY77

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
744	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 744	2672	rundll32.exe	84
PID 2672 wrote to memory of 744	2672	rundll32.exe	84
PID 2672 wrote to memory of 744	2672	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec6fc79710a6f7dba4f298cad2a701623c4b17f5187744d8053ec300e95ea33d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec6fc79710a6f7dba4f298cad2a701623c4b17f5187744d8053ec300e95ea33d.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:744