50b4176a0dfce346961f969f05c93ac287fb9707e9427aa65d073cdcdebfa705

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2023, 04:04

Target

50b4176a0dfce346961f969f05c93ac287fb9707e9427aa65d073cdcdebfa705.dll
Size

892KB
MD5

c25a035a34e85ae5cd7b1d38a811c749
SHA1

4b20ce87a526fe7229ff8bcac94459ee946cd16c
SHA256

50b4176a0dfce346961f969f05c93ac287fb9707e9427aa65d073cdcdebfa705
SHA512

282da029438af224d40e5e74f9a2a5cd49757ff436783cbccd91eb380d2159ab08b342f43867ca6881141b61f61dc69f3261dfe93a782681f5ec972cce6be34f
SSDEEP

12288:yJwwhEMf9shbYfQ1ZpOgSo/3DKKYxmSW1BcpQAe:yJwgXsFY417DSI3OKGmrSQAe

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4388	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4388	4544	rundll32.exe	84
PID 4544 wrote to memory of 4388	4544	rundll32.exe	84
PID 4544 wrote to memory of 4388	4544	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50b4176a0dfce346961f969f05c93ac287fb9707e9427aa65d073cdcdebfa705.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\50b4176a0dfce346961f969f05c93ac287fb9707e9427aa65d073cdcdebfa705.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4388