352a7b9a99690f5590fe0f1ecc059850fe82ad6c56c79183297a23b5756d73b3

Analysis

max time kernel
90s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 06:00

Target

9af0dbbb84641710ba88e514de7e3c14.dll
Size

25KB
MD5

9af0dbbb84641710ba88e514de7e3c14
SHA1

3b38c58320a61b43b32fe43a7366473a55ac27e2
SHA256

352a7b9a99690f5590fe0f1ecc059850fe82ad6c56c79183297a23b5756d73b3
SHA512

4e89d2c6814d662122b40a2615498026721662c05176d8be9416120f6d9429cff8c383d51c82c9a43418112d8bc437a8f354d388e6e062f84254377e0b280da7
SSDEEP

384:Mz+OaBjnhk5blOOA5otiDbNtWD6/n74luC3WIwauUZWqnN0lzra:U+Zhk5bgOEaiDbNo68luCGIwfWNEa

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4532	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 4532	4000	rundll32.exe	63
PID 4000 wrote to memory of 4532	4000	rundll32.exe	63
PID 4000 wrote to memory of 4532	4000	rundll32.exe	63

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9af0dbbb84641710ba88e514de7e3c14.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9af0dbbb84641710ba88e514de7e3c14.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4532