41fcd5be341624a3ab198101c8b623e3321adeb62198a29b907d6b231fc69e73

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2023 18:24

Target

41fcd5be341624a3ab198101c8b623e3321adeb62198a29b907d6b231fc69e73.dll
Size

401KB
MD5

297921cf5922b8dab498b1f2c026f28f
SHA1

d069f3c71ae4dbd07529a5fa0ac465284d85715c
SHA256

41fcd5be341624a3ab198101c8b623e3321adeb62198a29b907d6b231fc69e73
SHA512

b81e06ae381270efba09802f27ae9e0c42ea1e3291602a5ca443422e3204524e404297106fedd6b2e4b7318dcf839ae5b2e9535174c3b7706546d52d3ca14022
SSDEEP

6144:5k07oJEdZBAw9NWUojKsJXDJfKqgOi1GDhCU4be6LxNYb3MKnkQdUQDC6qJDl:XAwnWUojVNdsF1GcUYLxN4MAPCnN

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

4240 rundll32.exe

pid	process
4240	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 384 wrote to memory of 4240	384	rundll32.exe	rundll32.exe
PID 384 wrote to memory of 4240	384	rundll32.exe	rundll32.exe
PID 384 wrote to memory of 4240	384	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41fcd5be341624a3ab198101c8b623e3321adeb62198a29b907d6b231fc69e73.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41fcd5be341624a3ab198101c8b623e3321adeb62198a29b907d6b231fc69e73.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:4240

memory/4240-133-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download
memory/4240-134-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download
memory/4240-135-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download