3882794137cb2cf2fdaa24298a614d22ff87bbeb9f86246d8b169117f2faf157

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 19:25

Target

37c0c6854fa77667acad9ce7d1f54f31.dll
Size

67KB
MD5

37c0c6854fa77667acad9ce7d1f54f31
SHA1

2c261de7cd025f6bcf1a21312368b2c811711426
SHA256

3882794137cb2cf2fdaa24298a614d22ff87bbeb9f86246d8b169117f2faf157
SHA512

d3a03aa65dedf5a06944d98d935e02494baab48df3c11b8b87eeb5ad7f684fb8d04640810dc4da1f3b240ad60e8d22c503f59c6304fc4d572da458800bd3a3e3
SSDEEP

1536:6kISyZcdbACWMgI7vlgB3hdlcG/SUcWREwna4V7eLnkff3:6kBAuiBRPv/SGR2ix33

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\jinadezu.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\jaretalo	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1404	rundll32.exe
1404	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 1404	2668	rundll32.exe	16
PID 2668 wrote to memory of 1404	2668	rundll32.exe	16
PID 2668 wrote to memory of 1404	2668	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37c0c6854fa77667acad9ce7d1f54f31.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2668

memory/1404-0-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1404-2-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1404-1-0x00000000014E0000-0x000000000156D000-memory.dmp

Filesize
564KB

Download
memory/1404-3-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download