41f5f472d15f67d4cca92de863ef6fcae6d70ec0011f940c4d906bdeb30b57b8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 03:55

Target

0425b4a917e181321b53a28d38846988.dll
Size

48KB
MD5

0425b4a917e181321b53a28d38846988
SHA1

040c0992c30e6f3f450999cd25ea49b663bf51e1
SHA256

41f5f472d15f67d4cca92de863ef6fcae6d70ec0011f940c4d906bdeb30b57b8
SHA512

1bbd5b4e41725d1b89393654bcb2aa4eed54de97fb94742b8096a18bd47b5c517ea7d89894adf58c1bda4230352e2163da97ef99b508c6a7e55a37ed35782a37
SSDEEP

768:OcYLxct1huMx+43zosGdrUZjbgSSI/zMxKUM2Lk1NPIM5cSZ:4xjMo43zAlc97McT75cS

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3500	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 3500	4804	rundll32.exe	14
PID 4804 wrote to memory of 3500	4804	rundll32.exe	14
PID 4804 wrote to memory of 3500	4804	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0425b4a917e181321b53a28d38846988.dll,#1
1⤵
- Suspicious use of SetWindowsHookEx
PID:3500

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0425b4a917e181321b53a28d38846988.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804

memory/3500-6-0x00000000009C0000-0x00000000009D4000-memory.dmp

Filesize
80KB

Download
memory/3500-5-0x0000000001050000-0x0000000001051000-memory.dmp

Filesize
4KB

Download
memory/3500-4-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/3500-3-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download
memory/3500-2-0x0000000077AA2000-0x0000000077AA3000-memory.dmp

Filesize
4KB

Download
memory/3500-0-0x0000000077AA2000-0x0000000077AA3000-memory.dmp

Filesize
4KB

Download
memory/3500-1-0x0000000077AA2000-0x0000000077AA3000-memory.dmp

Filesize
4KB

Download