ccd1435a4f112cd6b28dd4351622db674c7dca64e3e7875bb1db36f3763e35ed

Analysis

max time kernel
67s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2023 19:52

Target

Plugins/32bit/HotKey.dll
Size

109KB
MD5

de8c5937aa1bc483b4755daf5c8a8653
SHA1

4dc94bf60970de4a06e9263561da52bbd38a4dc5
SHA256

8156db912e404003b8c3b037780c3c69900ff13c16bc99143d3aa18a6601c89c
SHA512

260639e91535f0b8e29a588549f415fec7433913646c032c00d412ab72539902d7f2fda521b641522b3d8622b8afc960d1233c830e736972b4cd1a64a21ac2fa
SSDEEP

1536:dEQBTsW9PtcdRGQRiVBZxls6L1lHc/8sLLP+oDyTeKM3x2gj3/HHa+nt7nkA4ybS:dE6jkRmBzl3l0d2SKM3x2/u4A4yb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2708	3312	rundll32.exe	82
PID 3312 wrote to memory of 2708	3312	rundll32.exe	82
PID 3312 wrote to memory of 2708	3312	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\32bit\HotKey.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\32bit\HotKey.dll,#1
  2⤵
  PID:2708