d6a8aa39d67e9e78bf2b99e9809c1b417c27e02af42f4bd24cf796b810cd0f67

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 05:22

Target

2006469339989/green/main/hook.dll
Size

375KB
MD5

fd99de6554e0d23d611a21d0aa6688db
SHA1

13f3acbbe5ba538bb982216189aec79c234ebcc2
SHA256

119d8b448698cbab512a18c9dbc09ca8355261732caf26de67f4efab460b617d
SHA512

cbaf58917ff09a839e9b00193ac7b43fa9af56608d5e7a642d021bf75c0e73d901c6eef7da242f1f7a5b5f584af65b646813a68852609075f409216c867a14e1
SSDEEP

6144:xoN84eftfFNhdDFhbIZs/mdn/FMdRwqyDMfvb0Na+XDejTucrkHLn22BLD:xoQl3DH0Zs/wtYRsMb0Na+Xbr2+

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1180	rundll32.exe
1180	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 1180	452	rundll32.exe	89
PID 452 wrote to memory of 1180	452	rundll32.exe	89
PID 452 wrote to memory of 1180	452	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2006469339989\green\main\hook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2006469339989\green\main\hook.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1180