a0a02f6955e3cc9376208bf4c56f675bb628957412bcfd3b2e8e717210643d7e

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 14:12

Target

3ec065e8964ebea6c24a196e0d244c50.dll
Size

83KB
MD5

3ec065e8964ebea6c24a196e0d244c50
SHA1

65ac0ef397c707f68b92cfdd186032e6d4db6f0f
SHA256

a0a02f6955e3cc9376208bf4c56f675bb628957412bcfd3b2e8e717210643d7e
SHA512

208483f1739f7b7dcdaeade838fafa841978a5d6e94686e8cb77a14aec42b7a20d3b317df7b5aedd97f0ab3fb01aed7d86a7426dc83b3089ba023b026f34496b
SSDEEP

1536:aEAVjPru0yBZggsWTPJzQ8U+7CgrmCajlKjDPGLH2zVU2me86LYYgXP1O:a1rqlZrsKxzTU+75SCvjDPYmweVYlXPs

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2760	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 2760	668	rundll32.exe	25
PID 668 wrote to memory of 2760	668	rundll32.exe	25
PID 668 wrote to memory of 2760	668	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec065e8964ebea6c24a196e0d244c50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec065e8964ebea6c24a196e0d244c50.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2760

memory/2760-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2760-1-0x00000000014A0000-0x00000000014AF000-memory.dmp

Filesize
60KB

Download
memory/2760-2-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2760-3-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download