41dd33da0f37f503c088866cbd14ad77feef2b3604d7e68e9609bf977953fda0

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2023 21:49

Target

41dd33da0f37f503c088866cbd14ad77feef2b3604d7e68e9609bf977953fda0.dll
Size

3.0MB
MD5

69b426d1c98b822cac1f8606130749f4
SHA1

fac431adee2cfb6fc6682bd452bbdbd369094d96
SHA256

41dd33da0f37f503c088866cbd14ad77feef2b3604d7e68e9609bf977953fda0
SHA512

424e73966c907bd4e33721c9a31532e2d796457bd03a6313bcc38766566f2d12e9cae28503f4e0c05d7b19193131d92db4d93ada2b6f9aa8712fe66e66f93c47
SSDEEP

49152:2vYjpCOCQdLzdHxI5ByzNaHjHrG3NamlhS24rQX9xe:3VCOCgXdS4zuYTV8uP

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1124	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 1124	4312	rundll32.exe	81
PID 4312 wrote to memory of 1124	4312	rundll32.exe	81
PID 4312 wrote to memory of 1124	4312	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41dd33da0f37f503c088866cbd14ad77feef2b3604d7e68e9609bf977953fda0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41dd33da0f37f503c088866cbd14ad77feef2b3604d7e68e9609bf977953fda0.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1124

memory/1124-133-0x0000000010000000-0x000000001034B000-memory.dmp

Filesize
3.3MB

Download
memory/1124-134-0x0000000010000000-0x000000001034B000-memory.dmp

Filesize
3.3MB

Download