27a40627efb3f5c49234789c03f084a95fa18d33292808428ea9960ea7685e55

Analysis

max time kernel
138s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2023, 08:15

Target

27a40627efb3f5c49234789c03f084a95fa18d33292808428ea9960ea7685e55.dll
Size

9.0MB
MD5

242dddda34375eddbb6dc5769706765b
SHA1

c0242f40eddc9759028f2fe63ae5aff0297c55c0
SHA256

27a40627efb3f5c49234789c03f084a95fa18d33292808428ea9960ea7685e55
SHA512

682d7b18d00a3ce17cfbb830f6c2d5614e2df6166f66181a65a8abd6363e367790e2fbdd5868032516ed7948db2b50921cebe5122ecd6bb0eff828d4e3a00ecd
SSDEEP

98304:ITib1PLHazUT4+5mcMW1YqyoSTWZANZD+E2RU:ITipz93RMWDueAND

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3260	rundll32.exe
3260	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3260	3496	rundll32.exe	82
PID 3496 wrote to memory of 3260	3496	rundll32.exe	82
PID 3496 wrote to memory of 3260	3496	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27a40627efb3f5c49234789c03f084a95fa18d33292808428ea9960ea7685e55.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27a40627efb3f5c49234789c03f084a95fa18d33292808428ea9960ea7685e55.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3260

memory/3260-136-0x00000000748F0000-0x00000000755B5000-memory.dmp

Filesize
12.8MB

Download
memory/3260-137-0x00000000748F0000-0x00000000755B5000-memory.dmp

Filesize
12.8MB

Download