a9b494fc240c2d83c7063c9a4a2b10455d2bf465d02965fc0b16a6bc3e622342

Analysis

max time kernel
128s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 00:47

Target
4a382522436bb28934b30870a894101e.dll
Size 769KB
Sample240108-a5cnwsadf4
SHA256 a9b494fc240c2d83c7063c9a4a2b10455d2bf465d02965fc0b16a6bc3e622342
MD5 4a382522436bb28934b30870a894101e
SHA1 81012a7ba3decbb86abbf52f06a0d25947fd33d1
SHA512 e61360a5a62d0b4746ba13bc251547a2cae6ab221b498c812d6e7391e07203df3f381c72820382cc662861301ba87be83b826085ef6a3f70557efb8e9e820d82
SSDEEP 384:lKDGsnOAiB40ipXqfImFECg9HWv0L2Jk5K1BGJ2lhifjLcz:lvsnBiG0w8I0EIv0qu5K1AUiO
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4616	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4616	4116	rundll32.exe	17
PID 4116 wrote to memory of 4616	4116	rundll32.exe	17
PID 4116 wrote to memory of 4616	4116	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a382522436bb28934b30870a894101e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a382522436bb28934b30870a894101e.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4616