d6a8aa39d67e9e78bf2b99e9809c1b417c27e02af42f4bd24cf796b810cd0f67

Analysis

max time kernel
134s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 05:22

Target

2006469339989/green/hook.dll
Size

375KB
MD5

fd99de6554e0d23d611a21d0aa6688db
SHA1

13f3acbbe5ba538bb982216189aec79c234ebcc2
SHA256

119d8b448698cbab512a18c9dbc09ca8355261732caf26de67f4efab460b617d
SHA512

cbaf58917ff09a839e9b00193ac7b43fa9af56608d5e7a642d021bf75c0e73d901c6eef7da242f1f7a5b5f584af65b646813a68852609075f409216c867a14e1
SSDEEP

6144:xoN84eftfFNhdDFhbIZs/mdn/FMdRwqyDMfvb0Na+XDejTucrkHLn22BLD:xoQl3DH0Zs/wtYRsMb0Na+Xbr2+

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	696	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1472	rundll32.exe
1472	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1472	2424	rundll32.exe	91
PID 2424 wrote to memory of 1472	2424	rundll32.exe	91
PID 2424 wrote to memory of 1472	2424	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2006469339989\green\hook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2006469339989\green\hook.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1472

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:696

memory/696-1-0x000001991D170000-0x000001991D180000-memory.dmp

Filesize
64KB

Download
memory/696-17-0x000001991D270000-0x000001991D280000-memory.dmp

Filesize
64KB

Download
memory/696-33-0x00000199255E0000-0x00000199255E1000-memory.dmp

Filesize
4KB

Download
memory/696-35-0x0000019925610000-0x0000019925611000-memory.dmp

Filesize
4KB

Download
memory/696-36-0x0000019925610000-0x0000019925611000-memory.dmp

Filesize
4KB

Download
memory/696-37-0x0000019925720000-0x0000019925721000-memory.dmp

Filesize
4KB

Download
memory/1472-0-0x0000000000930000-0x00000000009DB000-memory.dmp

Filesize
684KB

Download