5b631a4b85b4d28f2e1b412c0b636e592b970f70982ef0853e3903b1e70316ab

Analysis

max time kernel
129s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:47

Target

5b631a4b85b4d28f2e1b412c0b636e592b970f70982ef0853e3903b1e70316ab.dll
Size

628KB
MD5

4e69293084d66904773a1c1bdbabbf30
SHA1

c0051c6cbcc4402233dbbeeebc861619b05eea53
SHA256

5b631a4b85b4d28f2e1b412c0b636e592b970f70982ef0853e3903b1e70316ab
SHA512

b39a00de17fa5b7a26289b2d1c3d638c5fe6ac187b9ee36b2571a675576ccd2b9137e37ab09f57781ae92054fffc80a473602e5b018954ffd41e884daba83f8a
SSDEEP

6144:ESRJSkjBs7/+0W+ifcKr+E2KkS7Wgs4xmcIW5ZY7TaDsUHWbXkwKKwanVK/5:EoScMBW+ifcKaAx5xXY7s2bTnc/5

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1852 rundll32.exe

pid	process
1852	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1920 wrote to memory of 1852	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1852	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1852	1920	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b631a4b85b4d28f2e1b412c0b636e592b970f70982ef0853e3903b1e70316ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b631a4b85b4d28f2e1b412c0b636e592b970f70982ef0853e3903b1e70316ab.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:1852

memory/1852-0-0x0000000069E00000-0x0000000069FA0000-memory.dmp

Filesize
1.6MB

Download
memory/1852-5-0x0000000069800000-0x0000000069DB3000-memory.dmp

Filesize
5.7MB

Download