24da66819fb416af12a1a7e94c27b2db929e7050bfb59ef485e68181e0863437

Analysis

max time kernel
138s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2023 21:39

Target

24da66819fb416af12a1a7e94c27b2db929e7050bfb59ef485e68181e0863437.dll
Size

401KB
MD5

68827c807fc789f851665ec643dda39e
SHA1

84eafab2f2269358f35a53b91284c9bf0fcae6f7
SHA256

24da66819fb416af12a1a7e94c27b2db929e7050bfb59ef485e68181e0863437
SHA512

b70bc58fff6344e4370734becc82a1abaac09f503525866f9b7b863115f4a2375890b89bbb199912c29a2d9bcc371460d564d5f7b185258cb99eddc614149e9e
SSDEEP

12288:XAwnWUojVNdsF1zg8+vIKxUxxxUJwIZeCEN:X7nWUoVNyE8+vfx481ZeR

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1888 rundll32.exe

pid	process
1888	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1880 wrote to memory of 1888	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1888	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1888	1880	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24da66819fb416af12a1a7e94c27b2db929e7050bfb59ef485e68181e0863437.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24da66819fb416af12a1a7e94c27b2db929e7050bfb59ef485e68181e0863437.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:1888

memory/1888-133-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download
memory/1888-134-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download
memory/1888-135-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download