050a3db985fe0180e985301a918783faea7dd720cb7259c597f1ef5a0dad325a

Analysis

max time kernel
137s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2023 14:29

Target

winthrusterpropj/HookDLL/winmm.dll
Size

1.8MB
MD5

f0de5fbb6bc4ccf4dc7fa75cefbde6ab
SHA1

1d31386e208a0d6ad5c3251985a5861e2c3e6ed2
SHA256

fb4e1856d5ed28ae0c98d14199409d18a0c7cddff887d0c53c77aabec95dd646
SHA512

bbe0613d0ae4d4854666b7fefe91e553d1f5562253c862307d931b9b330e693d24902a519ddcebf61ab90aa9eb388962f347203009f0c5a9cd171ebfd5a4cf48
SSDEEP

49152:70NFi1E6dgWippxQxQ6Mhxj0NFZt0z0UPbxFWk/J:70ZcncoS6vrE029P

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

2844 rundll32.exe
2844 rundll32.exe
2844 rundll32.exe
2844 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 836 wrote to memory of 2844	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2844	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2844	836	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\winthrusterpropj\HookDLL\winmm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\winthrusterpropj\HookDLL\winmm.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2844

memory/2844-133-0x0000000000EF0000-0x0000000000EFE000-memory.dmp

Filesize
56KB

Download
memory/2844-134-0x0000000000EF0000-0x0000000000EFE000-memory.dmp

Filesize
56KB

Download
memory/2844-135-0x0000000000EF0000-0x0000000000EFE000-memory.dmp

Filesize
56KB

Download
memory/2844-137-0x0000000010000000-0x0000000010394000-memory.dmp

Filesize
3.6MB

Download
memory/2844-136-0x0000000001240000-0x0000000001241000-memory.dmp

Filesize
4KB

Download