aa4e7338acfe715ec4b44ece2c95f2fe8116a42fe3f54eea98d928e72fd1198e

Analysis

max time kernel
93s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2023 21:42

Target

aa4e7338acfe715ec4b44ece2c95f2fe8116a42fe3f54eea98d928e72fd1198e.dll
Size

1.7MB
MD5

9d662dc753c0734c3edb84314c4715eb
SHA1

30e868ed020840643757b1891000680060036ee5
SHA256

aa4e7338acfe715ec4b44ece2c95f2fe8116a42fe3f54eea98d928e72fd1198e
SHA512

0924790ef2a0e82222e0da85de077ee8841aa70cec2dbcee921a994d34d8122277b829dc98e362eca45776d40646bbf69625ab44d9120c5754fac28f7f174e74
SSDEEP

49152:QCFXmvleiVWpYw2XCIl20R7yBfICEwhFaDrK:dWvllVsv2XCp09y9EQFO

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

6 4296 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

4296 rundll32.exe

flow	pid	process
6	4296	rundll32.exe

pid	process
4296	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2148 wrote to memory of 4296	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 4296	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 4296	2148	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa4e7338acfe715ec4b44ece2c95f2fe8116a42fe3f54eea98d928e72fd1198e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa4e7338acfe715ec4b44ece2c95f2fe8116a42fe3f54eea98d928e72fd1198e.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetWindowsHookEx
  PID:4296

memory/4296-134-0x0000000000840000-0x0000000000843000-memory.dmp

Filesize
12KB

Download
memory/4296-133-0x0000000010000000-0x00000000104A5000-memory.dmp

Filesize
4.6MB

Download
memory/4296-135-0x0000000000840000-0x0000000000843000-memory.dmp

Filesize
12KB

Download