a7404c724452c381a880ac6c050eab05b28bfcdbc027a5f9ea39d32f1c514efc

Analysis

max time kernel
104s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 16:35

Target

700a617a11a2361bae81a01a05103381.dll
Size

296KB
MD5

700a617a11a2361bae81a01a05103381
SHA1

37b125412089d502c32aebf9ea108739fec09584
SHA256

a7404c724452c381a880ac6c050eab05b28bfcdbc027a5f9ea39d32f1c514efc
SHA512

9849b56789ca0a5c269efac34bc4d1fb89104a13156c712451527e95bd3b7dee74fbfbb2c3ca70f9a4c20cfdd96b4ae58cf1a1c147519b71db826774d355b96d
SSDEEP

6144:zVfEo2FAeDm55MHlrHPYFjIQvfSHMBlFHXV0B42Lbz6O11XIvS4SjuOqV:zDeDmwHlrHkEyntVHazHXXQ1qLc

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4888	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 4888	1976	rundll32.exe	86
PID 1976 wrote to memory of 4888	1976	rundll32.exe	86
PID 1976 wrote to memory of 4888	1976	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\700a617a11a2361bae81a01a05103381.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\700a617a11a2361bae81a01a05103381.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4888

memory/4888-0-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download
memory/4888-1-0x0000000000520000-0x0000000000525000-memory.dmp

Filesize
20KB

Download
memory/4888-2-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download
memory/4888-3-0x0000000000520000-0x0000000000525000-memory.dmp

Filesize
20KB

Download