e3daf9e07769c4d52ce231379e81cc07671f0fc1a49437eccc2509bd6d550190

Analysis

max time kernel
130s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 13:24

Target

e3daf9e07769c4d52ce231379e81cc07671f0fc1a49437eccc2509bd6d550190.dll
Size

5.6MB
MD5

4ac45287f29d444a993da8c43ceff81b
SHA1

cfdb48d472619e91368229fe348bdc186fb43a92
SHA256

e3daf9e07769c4d52ce231379e81cc07671f0fc1a49437eccc2509bd6d550190
SHA512

23be98b9e280c2ee8a3a6af00cd280b456035cb57e44fe790fbc83f354080b93459e50c06fae3b67875bd5c14c9ee61c4c7751e233cd03514d9c4c52cd2771dd
SSDEEP

49152:JMd2l+/kj9A0+JfbnXHaczfaWM3KjVPVdHuUefBdRX7e5pedHWdY5Loko8XD1Sgd:HAZJfbaczf/MWTdH2l7nZW651LaL/Uh

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4568	rundll32.exe
4568	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 4568	1244	rundll32.exe	81
PID 1244 wrote to memory of 4568	1244	rundll32.exe	81
PID 1244 wrote to memory of 4568	1244	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3daf9e07769c4d52ce231379e81cc07671f0fc1a49437eccc2509bd6d550190.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3daf9e07769c4d52ce231379e81cc07671f0fc1a49437eccc2509bd6d550190.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4568

memory/4568-0-0x00000000765B0000-0x00000000766A0000-memory.dmp

Filesize
960KB

Download
memory/4568-1-0x00000000765B0000-0x00000000766A0000-memory.dmp

Filesize
960KB

Download