453c1a8db997f6bfba6082ff441d2b78c355f2a3bdd4dcbd5e2f16bba0c3f4ad

Analysis

max time kernel
135s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 07:53

Target

Plugin/NRage_DInput8_161.dll
Size

37KB
MD5

2d214b8d91ce13efb395f80d95f03a6d
SHA1

c0851a0ba882cab72eea6eed7cabbd18d625506c
SHA256

e82f194a2374eaa7852c57f99b3cd5c4d8a86722072284ecef206fd5bd82f11e
SHA512

fbf3054a2dda5a433320c92187ca744ae7ee38912dc8f6265e6ac3f592f655d43f7c42a8d5096f83d2486c04f9832a83f21c8783086a5b752fa4192fa1df1fe3
SSDEEP

768:AEffjZNW2pQzYMDDChjH7UVqP10SNklbVAiq5EoRpOXrd1/nZzYJT:AWfjZLsWhj59jOP6pO7PvAT

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1292	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 1292	4100	rundll32.exe	90
PID 4100 wrote to memory of 1292	4100	rundll32.exe	90
PID 4100 wrote to memory of 1292	4100	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\NRage_DInput8_161.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\NRage_DInput8_161.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1292

memory/1292-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download