c2e53dd8ea050fb15921cafdfe7df4479797bf190b5d9f206d51669125cbbc52

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 21:49

Target

13cab4755952ae1a4e44923d1701ed93.dll
Size

27KB
MD5

13cab4755952ae1a4e44923d1701ed93
SHA1

c49c5f4814618bdeb3c1c736219530d6da76732c
SHA256

c2e53dd8ea050fb15921cafdfe7df4479797bf190b5d9f206d51669125cbbc52
SHA512

6c74d2e3653b01a87249013db873d1f295f50e63f2fc2e0d17f198c8d8c6118b04d7940832f7c3a6c0754d88782f8d21d5c319e7c0c1584606af4973aa2bb447
SSDEEP

384:hYeZBjMXIKJ1B7nz+4fd9Sp8WKOa0KjBX5wcNNcjc9ZfApo0E:meYIcnnz+SSJha0KjJqYcjc9ZfAk

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3680	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 3680	1828	rundll32.exe	88
PID 1828 wrote to memory of 3680	1828	rundll32.exe	88
PID 1828 wrote to memory of 3680	1828	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13cab4755952ae1a4e44923d1701ed93.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13cab4755952ae1a4e44923d1701ed93.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3680

memory/3680-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download