32fa5595dce6436cba4b74b70cf60a92fbefeda5960e6126c646d0afcffd0377

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 17:25

Target

32fa5595dce6436cba4b74b70cf60a92fbefeda5960e6126c646d0afcffd0377.dll
Size

778KB
MD5

5c432414e082bbcd924a74f079a6db68
SHA1

bbed555eec52eb4481bcd10eaaac7298755c32e2
SHA256

32fa5595dce6436cba4b74b70cf60a92fbefeda5960e6126c646d0afcffd0377
SHA512

17cd1d42ba05a6d4ee3eae0a3df64c5dd1b29c7b17c8691495a6572b86844efda3160037b70ff3b68b67bbe90ca5076dae0ff7cdc6972dd11727264e43188091
SSDEEP

24576:zgLTw1rC8urL5qUiGVFMx6RlOASMcFSn:6TmCBMUDFMQ/SMcF

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
452	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 452	4632	rundll32.exe	82
PID 4632 wrote to memory of 452	4632	rundll32.exe	82
PID 4632 wrote to memory of 452	4632	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32fa5595dce6436cba4b74b70cf60a92fbefeda5960e6126c646d0afcffd0377.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32fa5595dce6436cba4b74b70cf60a92fbefeda5960e6126c646d0afcffd0377.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:452

memory/452-0-0x0000000010000000-0x0000000010274000-memory.dmp

Filesize
2.5MB

Download
memory/452-1-0x0000000000CE0000-0x0000000000CE2000-memory.dmp

Filesize
8KB

Download