4c56ead181e661b18227bc58e9692c424e819f545bc3a4a975a0d44960f3972d

Analysis

max time kernel
93s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 02:55

Target
9a92e4d7ee6ae6b1b151200ae21bce8b.dll
Size 367KB
Sample240214-dehzrsfb61
SHA256 4c56ead181e661b18227bc58e9692c424e819f545bc3a4a975a0d44960f3972d
MD5 9a92e4d7ee6ae6b1b151200ae21bce8b
SHA1 b29633556a473327e16162881cbb0a08ddeae6c3
SHA512 3f498b72c8cf5257ca9a98d64eeb4b9668b5d2dc3307ffd4ab6029527e12a674075062252616de1c4ddab787d915f80da09849f7bde7d4b141b3d1b2d0cbd7cb
SSDEEP 6144:/GWUdHZuTbXKkINsIKdRB68B48n4AsoauvkiSgXq/J+LhF9dg9:NyHZuXX61EB5bJknV/kFFn0
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2576	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2576	1400	rundll32.exe	85
PID 1400 wrote to memory of 2576	1400	rundll32.exe	85
PID 1400 wrote to memory of 2576	1400	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a92e4d7ee6ae6b1b151200ae21bce8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a92e4d7ee6ae6b1b151200ae21bce8b.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2576