7708ac542c00c0c68ea9e8bc47f1db3278036f85ddd710e80e3865b0bdd1a67f

Analysis

max time kernel
138s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 22:57

Target

59a1288aab68d2631d5d085f33c2bbd5.dll
Size

848KB
MD5

59a1288aab68d2631d5d085f33c2bbd5
SHA1

42ab80b16f852927d969f738127bc36207d85e04
SHA256

7708ac542c00c0c68ea9e8bc47f1db3278036f85ddd710e80e3865b0bdd1a67f
SHA512

78ab982ef790af7c905a20632b0d44121871822b2ffd1dbee0a8575101a9ed2bdf23db318ae4216fb5800e45fdd0b8214d9ff522ae71be9a25a20cd65516fe69
SSDEEP

12288:zMeIaQB7OJEtlyeGEWq64tvJ3gVGuotIbD+HtfzTqlB/vj9k+6UktMaF5RxR/hea:ViB7OJveGjq64HgVk6qtf/q/L9k+klmG

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1876	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 1876	5048	rundll32.exe	88
PID 5048 wrote to memory of 1876	5048	rundll32.exe	88
PID 5048 wrote to memory of 1876	5048	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59a1288aab68d2631d5d085f33c2bbd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59a1288aab68d2631d5d085f33c2bbd5.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1876