694c4a5fc7fdf4c6a32aae37d35853bcb32e3360e521323e71c49dc937bfab6d

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2023 22:37

Target

694c4a5fc7fdf4c6a32aae37d35853bcb32e3360e521323e71c49dc937bfab6d.dll
Size

1.3MB
MD5

2de10c772b6f5670b5fe203b6b2e118f
SHA1

56d5dd7122deee559475ec6f4c3aa82b94afa0fb
SHA256

694c4a5fc7fdf4c6a32aae37d35853bcb32e3360e521323e71c49dc937bfab6d
SHA512

dfd220af6fafbbb062b97328ca97d6f952b4bb9f968c740d6e5473989c7b64f34dce841855ba6a6d8b089229daaacff624941c1baeb4850f9d63c20f922b405d
SSDEEP

12288:moGNcZXn1xDOrUgy8z6DT5dp7Q25oiY5K5b9WuxZLcqmGB:moicZX1lOFys6f5dO25oiMIMORmGB

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1072	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1072	1204	rundll32.exe	86
PID 1204 wrote to memory of 1072	1204	rundll32.exe	86
PID 1204 wrote to memory of 1072	1204	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\694c4a5fc7fdf4c6a32aae37d35853bcb32e3360e521323e71c49dc937bfab6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\694c4a5fc7fdf4c6a32aae37d35853bcb32e3360e521323e71c49dc937bfab6d.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1072