30b1457a43360850dd021bd17432c63b4988fdeae55e0fb5f393060ba1800e92

Analysis

max time kernel
147s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 12:43

Target

6f6626a671024650ed01a1c2311f1b08.dll
Size

85KB
MD5

6f6626a671024650ed01a1c2311f1b08
SHA1

3600f9c3effc7cfebb78beb13b7e031a2d0a13db
SHA256

30b1457a43360850dd021bd17432c63b4988fdeae55e0fb5f393060ba1800e92
SHA512

e54a3e2ca197b7ba63b8c0d11ff81bcf648711cf507cac923e18c63cd945e876cc42bde75ce2dea712e52b9b290d629ec07ba0cd8e2388a47b63d1038dd9b541
SSDEEP

1536:t5Zd1CG33MD2mmg29+2Oa0OYziAha31N2cqHk5LVxxqpQjYw44A7wcRAP5i7Di1B:93Bn/R9+jYY7+wHmxxQMYw44AscRs29Q

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4608	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 4608	3608	rundll32.exe	18
PID 3608 wrote to memory of 4608	3608	rundll32.exe	18
PID 3608 wrote to memory of 4608	3608	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f6626a671024650ed01a1c2311f1b08.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f6626a671024650ed01a1c2311f1b08.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4608

memory/4608-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4608-1-0x0000000001120000-0x000000000112F000-memory.dmp

Filesize
60KB

Download
memory/4608-2-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4608-3-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download