16684aa0a118286f696cabcede9396647073deb414ab3200470bd53a912d4ee1

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 16:39

Target

c11545645557d8a9a2699cc823ea37cd.dll
Size

30KB
MD5

c11545645557d8a9a2699cc823ea37cd
SHA1

36f8933641494ca88095475a0429714f32b9b2ce
SHA256

16684aa0a118286f696cabcede9396647073deb414ab3200470bd53a912d4ee1
SHA512

071241146c9d41660b0307ed2d47d190181ea7559863d666276fc2df8a0e26e489044df970a30ffd4b774b7894232bce3395bffba89913424aa5c5790647e24d
SSDEEP

384:L2tXXA9hq92y1LMCfWlXFdikqo/+M+US3Y9FyZyzst5yOZ1EKPVbR63k7nnYPLMq:LaQhqMRlXGkWMhS3Yfy4zsAOZhdbFnBq

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
908	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 908	208	rundll32.exe	89
PID 208 wrote to memory of 908	208	rundll32.exe	89
PID 208 wrote to memory of 908	208	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c11545645557d8a9a2699cc823ea37cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c11545645557d8a9a2699cc823ea37cd.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:908