3e02fc1a2195fd1f8b3eec0ac5b7052d88966e140f035784ac12b72ace31ec6e

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 08:17

Target

5f17cd69a197a2be968dd1f13ccee737.dll
Size

59KB
MD5

5f17cd69a197a2be968dd1f13ccee737
SHA1

5b7504c053fb6cfb111912ae6c22a51701fbc606
SHA256

3e02fc1a2195fd1f8b3eec0ac5b7052d88966e140f035784ac12b72ace31ec6e
SHA512

2de67ef2b8875ea6dc7dfd42d9d66c02dde37fcf9eddb9aa51c3032cbe6f829149b67aea1c8e52c4f07c00e8a04a994dd845a73db4ebc0a441ba96654218427a
SSDEEP

1536:6ONP97egpJSc+PWdiXudDpW3WwqAEgDXjaWSb2:l9esJSMFtI7zVana

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\nazuwedu.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\nonugomu	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3424	rundll32.exe
3424	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 3424	4624	rundll32.exe	87
PID 4624 wrote to memory of 3424	4624	rundll32.exe	87
PID 4624 wrote to memory of 3424	4624	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f17cd69a197a2be968dd1f13ccee737.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f17cd69a197a2be968dd1f13ccee737.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:3424

memory/3424-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/3424-1-0x0000000000E10000-0x0000000000E19000-memory.dmp

Filesize
36KB

Download
memory/3424-2-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/3424-3-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/3424-4-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/3424-5-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download