900e0f8b9e0aac7623544b42b77d2ab1b9421f57ac090fa5a62498b48e77cd79

Analysis

max time kernel
142s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 18:46

Target

358312ec93283b6fa7f84081968521f2.dll
Size

95KB
MD5

358312ec93283b6fa7f84081968521f2
SHA1

baab805bade70cd9b7024b0cb39fa08a44585420
SHA256

900e0f8b9e0aac7623544b42b77d2ab1b9421f57ac090fa5a62498b48e77cd79
SHA512

9af6b683e6b5f5c74bd1f01beb32edd4349ad748fcc107d1d53248db805f9d0f1163ce0eb32808c332a8d645abf8c563f6782c15e626fcd4e858719a6445f5dd
SSDEEP

1536:F4oFrx5PIki1hOMc0dP3L2Oe9tL9r/Yb8eIpu8tX79lJojguBKOm:F1lvLi1Hb1Pe919r2J8tXJlCjguBNm

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3940	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 3940	3208	rundll32.exe	80
PID 3208 wrote to memory of 3940	3208	rundll32.exe	80
PID 3208 wrote to memory of 3940	3208	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\358312ec93283b6fa7f84081968521f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\358312ec93283b6fa7f84081968521f2.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3940

memory/3940-1-0x0000000000F90000-0x0000000000FA2000-memory.dmp

Filesize
72KB

Download
memory/3940-3-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/3940-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/3940-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download