b963ac73fa4c505720004135ac5f91d22213c85c9ee38ebb1d80d5f8a41ab81a

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 09:24

Target

a1817103aa605b22f88aa6f041cd29d7.dll
Size

82KB
MD5

a1817103aa605b22f88aa6f041cd29d7
SHA1

a5e5743c123bc7d2b9405938d7b121962d42b663
SHA256

b963ac73fa4c505720004135ac5f91d22213c85c9ee38ebb1d80d5f8a41ab81a
SHA512

e575977141526c57632983e09adb67853236fd90097dc587a65ca44eac8493b38930f553548257edfbb811bbfce0a4429e41aaf8f40fa60df2600c2be0ddf306
SSDEEP

1536:M2PM8TDxdGctNH9ouKBnx/3uKoWxrcBmKsDeiL3tebHf7WNRj:1PMqDDEnZosrcsKzcAbzM

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1340	rundll32.exe
1340	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 1340	232	rundll32.exe	85
PID 232 wrote to memory of 1340	232	rundll32.exe	85
PID 232 wrote to memory of 1340	232	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1817103aa605b22f88aa6f041cd29d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1817103aa605b22f88aa6f041cd29d7.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1340

memory/1340-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1340-1-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1340-2-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download