5834d77274181f86868ddb05c31f30495846406ed11826317549ca7c7c2d9060

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2023 19:30

Target

5834d77274181f86868ddb05c31f30495846406ed11826317549ca7c7c2d9060.dll
Size

377KB
MD5

b8c06c5a31176e11367d6649225d004f
SHA1

693d4cc9cd195ac2c5908fb6588ff2442117ec64
SHA256

5834d77274181f86868ddb05c31f30495846406ed11826317549ca7c7c2d9060
SHA512

f98b3e8847d45bf9d476cdcc9511bfb15522b5d4296d9278387921e3da2c14b1ab8e146d4d89f22433629b012f14c5d73dd5a63169732e27f205ee4dc0173f24
SSDEEP

6144:hBopz+s95D/QPpTxih5CGeszK+I2GpgKAVbZo2hanuBhvMYn4Nxn:h+T5zkih5CGDKRvpgJJZoia+vx4Nxn

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4476 rundll32.exe
4476 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

4476 rundll32.exe

pid	process
4476	rundll32.exe
4476	rundll32.exe

pid	process
4476	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4936 wrote to memory of 4476	4936	rundll32.exe	rundll32.exe
PID 4936 wrote to memory of 4476	4936	rundll32.exe	rundll32.exe
PID 4936 wrote to memory of 4476	4936	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5834d77274181f86868ddb05c31f30495846406ed11826317549ca7c7c2d9060.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4936

memory/4476-134-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/4476-133-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/4476-135-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/4476-136-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download