4a971ef21bcacd95e907c2b6c9063744ef89b14a787d099b9bf5eeea3eed40f9

Analysis

max time kernel
140s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 07:58

Target

4a971ef21bcacd95e907c2b6c9063744ef89b14a787d099b9bf5eeea3eed40f9.dll
Size

1.8MB
MD5

8a06a9d412f53739bf5ceaa5a31c1560
SHA1

480d6b0922d1794449fe3f007f33a2903c6d6063
SHA256

4a971ef21bcacd95e907c2b6c9063744ef89b14a787d099b9bf5eeea3eed40f9
SHA512

a8fef74cddcd4a1066aa48e8ac4d9809c25947982ba3cfb864218f16c393be857fdcfe05c762105c8bc20ae3f7a5a114a551fd2f3c8c4782c90acad11a6dcf2b
SSDEEP

49152:Em+5PmCCs3v+s8KuqGaX0ToIBAUZLY83:vYPmFsUJBAUZLn

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4932	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4932	2512	rundll32.exe	89
PID 2512 wrote to memory of 4932	2512	rundll32.exe	89
PID 2512 wrote to memory of 4932	2512	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a971ef21bcacd95e907c2b6c9063744ef89b14a787d099b9bf5eeea3eed40f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a971ef21bcacd95e907c2b6c9063744ef89b14a787d099b9bf5eeea3eed40f9.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4932