e4bbd4323f29a5781909dd8b7e030607eb49c77659fd94b37ac0ab8a7ee4de07

Analysis

max time kernel
142s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 03:33

Target

034f0ffe5ac9d233798d471d99383f66.dll
Size

100KB
MD5

034f0ffe5ac9d233798d471d99383f66
SHA1

db23949fc139b2ecc735a558e146709898884935
SHA256

e4bbd4323f29a5781909dd8b7e030607eb49c77659fd94b37ac0ab8a7ee4de07
SHA512

f312e0978784ed48ce43a7a967d3fb18e2467631d395c46f2d6dd314d3ba6cb81f7f8929a3eb0934789466a0caa4bb3e0a1b0a01f405568fa1a5ef9747faca61
SSDEEP

1536:Dnys5590LogsjTKSH7E+tDSpx9hqBqF3KlBniV14ba:Dnym59Qogsa+tDSpfh1F3KlBni6a

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4420	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 4420	3524	rundll32.exe	82
PID 3524 wrote to memory of 4420	3524	rundll32.exe	82
PID 3524 wrote to memory of 4420	3524	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\034f0ffe5ac9d233798d471d99383f66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\034f0ffe5ac9d233798d471d99383f66.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4420