6cb421adfc12bd3806e6914064c35fc9c6c73366266f3bb9b8b6a2785810c8c0

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 12:02

Target

48ecb3f48ff291c03f7df59f4dfc5a0b.dll
Size

314KB
MD5

48ecb3f48ff291c03f7df59f4dfc5a0b
SHA1

92c6bdff0d404300b66fdd63466705176010875b
SHA256

6cb421adfc12bd3806e6914064c35fc9c6c73366266f3bb9b8b6a2785810c8c0
SHA512

1cb7dd3a7f7df103b9d4c74f533a5571974b74608fafd47a4843fabe4b0adab31317d3468e0f9518baa0134a8b62f05d0416c02563f3c92ae5928a7be880690a
SSDEEP

6144:3iY1oHcrg8FxebsUlFhbHaNcRdhUVwZx+AvP1EUfXykYCs1uKgTPu35+obqqv:3tW8rDEw6hHRdhUVgHFVHsgZW35+6qqv

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1596	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 1596	3156	rundll32.exe	89
PID 3156 wrote to memory of 1596	3156	rundll32.exe	89
PID 3156 wrote to memory of 1596	3156	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48ecb3f48ff291c03f7df59f4dfc5a0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48ecb3f48ff291c03f7df59f4dfc5a0b.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1596

memory/1596-0-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download
memory/1596-1-0x0000000001320000-0x0000000001325000-memory.dmp

Filesize
20KB

Download
memory/1596-2-0x0000000001320000-0x0000000001325000-memory.dmp

Filesize
20KB

Download