4eb6065078971468cb7e4b6c0efbff730268550446f9ce16256248b1a4d25086

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 14:33

Target

4eb6065078971468cb7e4b6c0efbff730268550446f9ce16256248b1a4d25086.dll
Size

1.2MB
MD5

bf1d9c4ac5194bc875e58fb77e4eb8af
SHA1

074b8f758bfb6dfbb516d221684134e0f216b717
SHA256

4eb6065078971468cb7e4b6c0efbff730268550446f9ce16256248b1a4d25086
SHA512

15262d8debd28e56f8d381f4c06f42a1a5cacabb67a55457cbbf6893755dfc72b49ca1125e0e2c49dd366b4b9d6272f3f9a50acc707ea956e9a7b9b039376fa7
SSDEEP

24576:TfBb1Ty8D7jIZRXK926gBfpo1rI/oyHR:TzTPjIZF9XBf2OAyHR

Score

1^/10

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 3352	800	rundll32.exe	85
PID 800 wrote to memory of 3352	800	rundll32.exe	85
PID 800 wrote to memory of 3352	800	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4eb6065078971468cb7e4b6c0efbff730268550446f9ce16256248b1a4d25086.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4eb6065078971468cb7e4b6c0efbff730268550446f9ce16256248b1a4d25086.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3352