96a5ff8a6168a597013f69e60535219f2d4f43984356e00d5fed173f6bec8391

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 18:28

Target

348335a2825e09e972adaa959683b366.dll
Size

96KB
MD5

348335a2825e09e972adaa959683b366
SHA1

f4b22035f40ae0ec1fdba74cab63285062ff1557
SHA256

96a5ff8a6168a597013f69e60535219f2d4f43984356e00d5fed173f6bec8391
SHA512

de4a7637f9f25109658a99385f8aaa9c258938c7693f44c2be71929d65c1d2880a8013ec22ca0c877d82e20c90661e88a29118c8ba6ef88a537a15bf6342c829
SSDEEP

3072:sxqwssvJvZNRJCYnYvLuIU2qu0747Rhu5Wtk:HwsshvZNRgYny1U747R0b

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2908	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 2908	4468	rundll32.exe	64
PID 4468 wrote to memory of 2908	4468	rundll32.exe	64
PID 4468 wrote to memory of 2908	4468	rundll32.exe	64

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\348335a2825e09e972adaa959683b366.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\348335a2825e09e972adaa959683b366.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2908

memory/2908-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2908-1-0x00000000007A0000-0x00000000007B2000-memory.dmp

Filesize
72KB

Download
memory/2908-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2908-4-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2908-3-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download