0e1ba258d670b5f7081f263883d11d97e606d052f808ab5aaf971e0c092e5a78

Analysis

max time kernel
141s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 20:27

Target

031a9d959312339eb94ca367ce110d57.dll
Size

16KB
MD5

031a9d959312339eb94ca367ce110d57
SHA1

58db269334540887cb88a2f76b304eea5ab549f8
SHA256

0e1ba258d670b5f7081f263883d11d97e606d052f808ab5aaf971e0c092e5a78
SHA512

8d2a6da75aaa703ee55fdb2ef69dec52ae1b9b5f8c7031cb3cbd51b99499988cd0419b5a4e0faf391b7bdf7eee10926c79507bdce726bcf634cf71ac3fc7f3c6
SSDEEP

384:pmLsi5EUzKh6TCuLZ5HatkOI8JLrsFPr4pXLzabIv/gPziiiTT9:4LD/zKYTCuL3Ha2OLBrsmZqjz6

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3864	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 3864	4492	rundll32.exe	14
PID 4492 wrote to memory of 3864	4492	rundll32.exe	14
PID 4492 wrote to memory of 3864	4492	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\031a9d959312339eb94ca367ce110d57.dll,#1
1⤵
- Suspicious use of SetWindowsHookEx
PID:3864

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\031a9d959312339eb94ca367ce110d57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4492

memory/3864-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download