aebc8658d3b2aedafab000294ad49f86473a02fcb4938c722d42ab95a6c12547

Analysis

max time kernel
66s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 14:24

Target

aebc8658d3b2aedafab000294ad49f86473a02fcb4938c722d42ab95a6c12547.dll
Size

218KB
MD5

c43d9ce155273c402a91e82c71b7e53a
SHA1

984cdac4942e43c297b804b549499135f02f1ae0
SHA256

aebc8658d3b2aedafab000294ad49f86473a02fcb4938c722d42ab95a6c12547
SHA512

3b0995485b47c5199657b8a26c70268a55d34660dea95764158927545a0a01a63052210c4d9b1b555befade1b66b9052b0dfe21c79591616c1038ff98bf02be5
SSDEEP

3072:T+GPUTsjpMlXeZe/mD2fkJrET7U1vF8YgNzrbuncskUjSf8DyvOPPXXWOltCBuEc:TJFtCBtKBxmE7MA

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1020	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 1020	2652	rundll32.exe	84
PID 2652 wrote to memory of 1020	2652	rundll32.exe	84
PID 2652 wrote to memory of 1020	2652	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aebc8658d3b2aedafab000294ad49f86473a02fcb4938c722d42ab95a6c12547.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aebc8658d3b2aedafab000294ad49f86473a02fcb4938c722d42ab95a6c12547.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1020