9f23cf013bbb530df240baae1e56d8fa669458ab5221640210d643bf1c3ead45

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2023 21:36

Target

9f23cf013bbb530df240baae1e56d8fa669458ab5221640210d643bf1c3ead45.dll
Size

912KB
MD5

b56b98ff7f1f15782c0d24a39c498995
SHA1

493a179406e7235423f7a16c97e62e99b41be20e
SHA256

9f23cf013bbb530df240baae1e56d8fa669458ab5221640210d643bf1c3ead45
SHA512

441dc30b1d516fe1ca8d15ec208d73aee99755f8714137f725bc8c38f95a05efeb29a67a97334f47bb58f3944a4792ee1b53a4d067aa3b27a3074c4a7287b570
SSDEEP

12288:xvsSNJGaA8RG4zUpwy7InjOzaa98LisHjHdrVIhJIJZ:xvt5wpN7Inj490iy5rVmJIJZ

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4432	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 4432	900	rundll32.exe	81
PID 900 wrote to memory of 4432	900	rundll32.exe	81
PID 900 wrote to memory of 4432	900	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f23cf013bbb530df240baae1e56d8fa669458ab5221640210d643bf1c3ead45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f23cf013bbb530df240baae1e56d8fa669458ab5221640210d643bf1c3ead45.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4432