1a8dbff8d74c193d7baa8a79951ca1f13761e51c1e0188fbcb615c4b0428a45e

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2023, 00:08

Target

1a8dbff8d74c193d7baa8a79951ca1f13761e51c1e0188fbcb615c4b0428a45e.dll
Size

374KB
MD5

c38d8d6fb845939fc5705c06863ca4f2
SHA1

80e2cdb1cc75c15b41f615bd3b794b4ed4f1f2bb
SHA256

1a8dbff8d74c193d7baa8a79951ca1f13761e51c1e0188fbcb615c4b0428a45e
SHA512

4fe3dd4cfb215156e1096a8e8103f5d1f317f7b51586942b35b2d61c322d302b9d5b378395b14c797b5bf6cb444aec60b99382e699a5e72363a0f0c4b160fa65
SSDEEP

6144:2phgJ0OM9cQUSULju4uFv02WRp5vMI5kU71tfxrPVg1aUDZ2x:1J06hr8mPC4UNa

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3632	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 3632	3884	rundll32.exe	84
PID 3884 wrote to memory of 3632	3884	rundll32.exe	84
PID 3884 wrote to memory of 3632	3884	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a8dbff8d74c193d7baa8a79951ca1f13761e51c1e0188fbcb615c4b0428a45e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a8dbff8d74c193d7baa8a79951ca1f13761e51c1e0188fbcb615c4b0428a45e.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3632