8a99bef4d143c38c39c3a391a0937e4263a1cdf0daa68949455bd44f71121bf6

Analysis

max time kernel
134s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 21:30

Target

7b52d618a94315c99b279504478685f2.dll
Size

52KB
MD5

7b52d618a94315c99b279504478685f2
SHA1

3aa4fe95f209efcb4a294d002dedec2ed5fda5b8
SHA256

8a99bef4d143c38c39c3a391a0937e4263a1cdf0daa68949455bd44f71121bf6
SHA512

255575fa5b43e99c5a89d4fb7ff293c7f782da9f83a932153edf0d4ff588f0d484fb7282b48f39e8d1f4e0a688e9fbdbe31c03706d1c2c355758782fadea6904
SSDEEP

1536:KhgOWCWnepjm64tfhpgv5x4QiMGpLHFuC:KgroSqiMGhHFuC

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3580	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 3580	1592	rundll32.exe	88
PID 1592 wrote to memory of 3580	1592	rundll32.exe	88
PID 1592 wrote to memory of 3580	1592	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b52d618a94315c99b279504478685f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b52d618a94315c99b279504478685f2.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3580

memory/3580-0-0x00000000026E0000-0x00000000026E9000-memory.dmp

Filesize
36KB

Download
memory/3580-1-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/3580-2-0x0000000002720000-0x0000000002729000-memory.dmp

Filesize
36KB

Download
memory/3580-3-0x00000000773C2000-0x00000000773C3000-memory.dmp

Filesize
4KB

Download
memory/3580-4-0x00000000773C2000-0x00000000773C3000-memory.dmp

Filesize
4KB

Download
memory/3580-5-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/3580-6-0x0000000002720000-0x0000000002729000-memory.dmp

Filesize
36KB

Download
memory/3580-7-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/3580-8-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/3580-9-0x0000000002720000-0x0000000002729000-memory.dmp

Filesize
36KB

Download
memory/3580-10-0x0000000000450000-0x0000000000464000-memory.dmp

Filesize
80KB

Download