c37c8d793971b66917a1fb8463e5255ef2a20b4a6ae902cfe45802364c956217

Analysis

max time kernel
142s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 09:42

Target

64a06306b3b68f3e489dc6cf57296420.dll
Size

93KB
MD5

64a06306b3b68f3e489dc6cf57296420
SHA1

eead14996804b1b48e9e0fbf2c079a658769d61d
SHA256

c37c8d793971b66917a1fb8463e5255ef2a20b4a6ae902cfe45802364c956217
SHA512

6ae90180968b1fd198b1512780362f910271ade0e6a1d3ea4286e260ed3dc49c9d30e46e57b6165f873dbbac4796ae9ec1a9c34e7fb4cada9fd4f03766b7c255
SSDEEP

1536:O/IBuAzbrf3Ktx19lESiCEpeFP9zCuy+c2Y4c0oGet03q9aOZKJyQoppAptc8Lp:OQzbz672SPUeb5y+cP4foGfONZcmppAp

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3568	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 3568	3656	rundll32.exe	88
PID 3656 wrote to memory of 3568	3656	rundll32.exe	88
PID 3656 wrote to memory of 3568	3656	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64a06306b3b68f3e489dc6cf57296420.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64a06306b3b68f3e489dc6cf57296420.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3568

memory/3568-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/3568-1-0x0000000000770000-0x0000000000782000-memory.dmp

Filesize
72KB

Download
memory/3568-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/3568-3-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/3568-4-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download