28333ff893ee2861827e2b613fe0e8a1a4ab33c7aed910fe9370bf857f97f515

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 17:15

Target

28333ff893ee2861827e2b613fe0e8a1a4ab33c7aed910fe9370bf857f97f515.dll
Size

717KB
MD5

374ff41c3fc9ce0aeac091557ce1351e
SHA1

fe6d77cd949872f8f1e3534074e0dec34b4e09c5
SHA256

28333ff893ee2861827e2b613fe0e8a1a4ab33c7aed910fe9370bf857f97f515
SHA512

7e15d1a15c81480a01492a9564513a7127d7207d991f52315dbd457473d46d5431a94ca662be1535d9d72c7df96fca676a1fbaee18d1c77109320234ad262425
SSDEEP

12288:GTa1Iv5YLz43SeTlDM46/MCiQLG03fzdCkA8Y0ttl3ZmFFOMPKcl:GzhVX7ChxY0lZmP

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1836	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 1836	3460	rundll32.exe	82
PID 3460 wrote to memory of 1836	3460	rundll32.exe	82
PID 3460 wrote to memory of 1836	3460	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28333ff893ee2861827e2b613fe0e8a1a4ab33c7aed910fe9370bf857f97f515.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28333ff893ee2861827e2b613fe0e8a1a4ab33c7aed910fe9370bf857f97f515.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1836

memory/1836-1-0x0000000000B40000-0x0000000000B43000-memory.dmp

Filesize
12KB

Download
memory/1836-0-0x0000000010000000-0x0000000010273000-memory.dmp

Filesize
2.4MB

Download
memory/1836-2-0x0000000000B40000-0x0000000000B43000-memory.dmp

Filesize
12KB

Download