150883b007f3dc81ab1367aa40a3da50398973918a6a29c3d555172c759d73b8

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 12:52

Target

997882766638e9eae7f2ec49b342cf37.dll
Size

644KB
MD5

997882766638e9eae7f2ec49b342cf37
SHA1

2ecffb7c6e9f12b4cb6d977c7f866d8d732315dc
SHA256

150883b007f3dc81ab1367aa40a3da50398973918a6a29c3d555172c759d73b8
SHA512

0758354cc82166544f1095cd48ae36016e71e8cae96c5d03c670d8cff8969dffd866c6d0e9a2948923ad559e59034222d2552689aa30b4cae59107326188e2e5
SSDEEP

6144:tUegFx1IOmCN8koMfCyy9OvmnZFWCejY8rcv+e8wqzYU7uaZeW4uhK/pPet4Lsun:tUegCCNxTfCyyEqx2lz3p

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1952	rundll32.exe
1952	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1952	640	rundll32.exe	85
PID 640 wrote to memory of 1952	640	rundll32.exe	85
PID 640 wrote to memory of 1952	640	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\997882766638e9eae7f2ec49b342cf37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\997882766638e9eae7f2ec49b342cf37.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1952