b9b2bed64bcb122ad73a595e82cfe57982ff4aef13756ac287554c42268af4af

Analysis

max time kernel
91s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2023 21:01

Target

b9b2bed64bcb122ad73a595e82cfe57982ff4aef13756ac287554c42268af4af.dll
Size

1.4MB
MD5

7ff500c308bef438320e19dba723fd47
SHA1

f617104e96eeca193f65de477b2ea1ccda4ceda6
SHA256

b9b2bed64bcb122ad73a595e82cfe57982ff4aef13756ac287554c42268af4af
SHA512

9e8bbcedf5d2a6efc20c42fff233dbf25a879d4342e4b4f7ed081d4ef8b30cce1dc6e8a0310f1c139e8a0b8ae85e5c6b4d40f34dda3c46bf96f7e40e75c3134c
SSDEEP

24576:xWVRm9ou2PJvtoH5/eLaITlEtUdaU32914KGE0lMa:s7Du2Rv2/e+Ie7ac1Z0lMa

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

20 5000 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

5000 rundll32.exe

flow	pid	process
20	5000	rundll32.exe

pid	process
5000	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 984 wrote to memory of 5000	984	rundll32.exe	rundll32.exe
PID 984 wrote to memory of 5000	984	rundll32.exe	rundll32.exe
PID 984 wrote to memory of 5000	984	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9b2bed64bcb122ad73a595e82cfe57982ff4aef13756ac287554c42268af4af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:984

memory/5000-133-0x0000000010000000-0x0000000010408000-memory.dmp

Filesize
4.0MB

Download
memory/5000-134-0x0000000001310000-0x0000000001313000-memory.dmp

Filesize
12KB

Download