e0ba81084d5dd0eca209812939d17af4aeaa19eb426a67b93deac7c091a2c66b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 12:28

Target

1e5ceb922ac2dd9a99fc0eb8cad7734f.dll
Size

705KB
MD5

1e5ceb922ac2dd9a99fc0eb8cad7734f
SHA1

07c01aef074b6128ac4ed49bb8463ed7dc285aab
SHA256

e0ba81084d5dd0eca209812939d17af4aeaa19eb426a67b93deac7c091a2c66b
SHA512

ca7acc13cae561e069849fdb5f2a96051aa6a57930d64490920db80eb81b4cad2080a751fb6049b86cbe35142e9dce8e6afa019374c337330f40cb60b62366a2
SSDEEP

12288:LaXF2c2llbHDgmwkD8M8KMnQZJTXxcGsIH4jMw8LuBJsE00yqC1V4o4bHr/:eX32llr6koM8KGQbX+nIYjH8LuBXDy7M

Score

1^/10

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 1744	4896	rundll32.exe	90
PID 4896 wrote to memory of 1744	4896	rundll32.exe	90
PID 4896 wrote to memory of 1744	4896	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e5ceb922ac2dd9a99fc0eb8cad7734f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e5ceb922ac2dd9a99fc0eb8cad7734f.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1744

memory/1744-0-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/1744-1-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download