aadf3f56cab8af21abe9674f7a6a58ba0467b7e84f3aba727fd77b3d788aa375

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 17:34

Target

659ef93b8c4c13b754262de46d2b777f.dll
Size

96KB
MD5

659ef93b8c4c13b754262de46d2b777f
SHA1

523f7af7e0411538cdb5195201daadebe1539404
SHA256

aadf3f56cab8af21abe9674f7a6a58ba0467b7e84f3aba727fd77b3d788aa375
SHA512

1be628b1e5debd54ca7ca5336f68ae3bf35caf7a57d062b43d00341427d8e5bc1d5f316d569b635b72cf4d7d997afe8f5724aa7e8b140f028e0b06b95a697e22
SSDEEP

3072:BXYMZXV2jiv6FDVo8oyU8WFiIvmdxWWcRBbx2dOAf9ItiIRf:BXXXiBFDeJiQmd6Vx25ItdB

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4536	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 4536	1036	rundll32.exe	87
PID 1036 wrote to memory of 4536	1036	rundll32.exe	87
PID 1036 wrote to memory of 4536	1036	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\659ef93b8c4c13b754262de46d2b777f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\659ef93b8c4c13b754262de46d2b777f.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4536

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:3288

memory/3288-4-0x000001C0D0780000-0x000001C0D0790000-memory.dmp

Filesize
64KB

Download
memory/3288-20-0x000001C0D0880000-0x000001C0D0890000-memory.dmp

Filesize
64KB

Download
memory/3288-36-0x000001C0D8BF0000-0x000001C0D8BF1000-memory.dmp

Filesize
4KB

Download
memory/3288-40-0x000001C0D8D30000-0x000001C0D8D31000-memory.dmp

Filesize
4KB

Download
memory/3288-39-0x000001C0D8C20000-0x000001C0D8C21000-memory.dmp

Filesize
4KB

Download
memory/3288-38-0x000001C0D8C20000-0x000001C0D8C21000-memory.dmp

Filesize
4KB

Download
memory/4536-0-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/4536-1-0x0000000000770000-0x0000000000782000-memory.dmp

Filesize
72KB

Download
memory/4536-2-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/4536-3-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download