62bcfa2778531cfd612c144bb77ec91e16660af5de2192aca0848616b3791c05

Analysis

max time kernel
136s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27-08-2023 22:07

Target

Abo1ut/open1gl232s21w.dll
Size

14.5MB
MD5

3bd5aea364326cdfa667651a93e7a4c9
SHA1

f33b4a83e038363c1a4df919e6f6e0e41dba9334
SHA256

23f04ba936568e9a7c9dce7a6beb52c9be7eb13b734cd390c99e7546cbe1973d
SHA512

7bd4e742b4d683b79de54eaf7d8b215252212921b8a53d1fbfc8e51ce43505c003da62fd126663bc04bbc65b8f77b85232c78ea6ecba8a4e425c28c0e9c80dc3
SSDEEP

393216:00Rly5ZnSHLe1tvwDTtwJuefdrX780dNYbg4A358TjGNrS1aKbBICZBSJLGWIGC2:NRlyP71tvwDTtwJuefdrX780dNYbg4Az

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3260	rundll32.exe
3260	rundll32.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 3260	3852	rundll32.exe	79
PID 3852 wrote to memory of 3260	3852	rundll32.exe	79
PID 3852 wrote to memory of 3260	3852	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Abo1ut\open1gl232s21w.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Abo1ut\open1gl232s21w.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3260