eaf5640d8fdfe21392ca4ece48e17a4b2c8bbe001d29801262ce08a8f0104d87

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 23:25

Target

d4a03dbe4fd6d88149f28ea9173a6f8d.dll
Size

86KB
MD5

d4a03dbe4fd6d88149f28ea9173a6f8d
SHA1

091671cba5c8dce4af7a4fccaeb08974e36d2837
SHA256

eaf5640d8fdfe21392ca4ece48e17a4b2c8bbe001d29801262ce08a8f0104d87
SHA512

9cada5ff8b7a4b2e3bc1fc409512e79de80265a21dd52f58ee7b4e325f5f5d665b6392c01107ea86ee7f6030015f116f6cb7b3d78258729caac5349e66536a2d
SSDEEP

1536:bomMq+jSnjnkAC4Tvfw3SBJ1ug2TGx5/wLHv0+BndeVc+BlnllYk0++u7vsH/IUs:bBM/cjnkcw3Sv260LHR6c+3lJ0zasHGl

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3808	rundll32.exe
3808	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3808	4064	rundll32.exe	92
PID 4064 wrote to memory of 3808	4064	rundll32.exe	92
PID 4064 wrote to memory of 3808	4064	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4a03dbe4fd6d88149f28ea9173a6f8d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4a03dbe4fd6d88149f28ea9173a6f8d.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:4200

memory/3808-0-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/3808-1-0x00000000007E0000-0x00000000007E5000-memory.dmp

Filesize
20KB

Download
memory/3808-2-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/3808-3-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/3808-4-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/3808-5-0x00000000007E0000-0x00000000007E5000-memory.dmp

Filesize
20KB

Download