e532ee8a1bc71ef586317cbb04241bebe427f2d5d1e9943b124d431ae6423969

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 04:11

Target

049b0df0647173a077d06112df519ec8.dll
Size

100KB
MD5

049b0df0647173a077d06112df519ec8
SHA1

3c7423db7bbe4f842fd50acd567d19a87544c85f
SHA256

e532ee8a1bc71ef586317cbb04241bebe427f2d5d1e9943b124d431ae6423969
SHA512

e849d949503b118259253341f611a57e9b2098a3438e4c6fe746e48e294bfc88cfe7feac23ab13a49fb5d6299aec950cc08461109d06afcb9aac653dc5a6e596
SSDEEP

1536:Dnys5590LogsjTKSH7E+tDSpx9hqBqF3KlBniV14ba:Dnym59Qogsa+tDSpfh1F3KlBni6a

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3908	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 3908	3188	rundll32.exe	14
PID 3188 wrote to memory of 3908	3188	rundll32.exe	14
PID 3188 wrote to memory of 3908	3188	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\049b0df0647173a077d06112df519ec8.dll,#1
1⤵
- Suspicious use of SetWindowsHookEx
PID:3908

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\049b0df0647173a077d06112df519ec8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3188