50395a1d19ed8f39d49f536967caa9e539056a7e98175081c5e0c5a76390a458

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 12:07

Target

7232d3f9a5616d71898986372d86caaa.dll
Size

94KB
MD5

7232d3f9a5616d71898986372d86caaa
SHA1

ceca3537b78d7588ef19271db8034ac0d256ad07
SHA256

50395a1d19ed8f39d49f536967caa9e539056a7e98175081c5e0c5a76390a458
SHA512

0382ac559de85e4479c076ea55b15dd2b84301f173ad3b1617b96e9ebf39959797243a3a9dcddebcecfb95290b2326dedc3128154e42818150bec91817b9ab25
SSDEEP

1536:bTahmQxAK1YumdAlmH1+X3CQO7ILpPavp8xPXg6w6bGVeDVudIz1:bKmQCKFmd8ycvVyhw9v0iod81

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2984	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2984	1312	rundll32.exe	86
PID 1312 wrote to memory of 2984	1312	rundll32.exe	86
PID 1312 wrote to memory of 2984	1312	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7232d3f9a5616d71898986372d86caaa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7232d3f9a5616d71898986372d86caaa.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2984

memory/2984-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2984-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2984-1-0x0000000000FB0000-0x0000000000FC2000-memory.dmp

Filesize
72KB

Download
memory/2984-3-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download