21e1f6ab3dcefd8ec20a425824885a74181f1b3519ceb6933cd14961fef047af

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 23:50

Target

21e1f6ab3dcefd8ec20a425824885a74181f1b3519ceb6933cd14961fef047af.dll
Size

5.1MB
MD5

b84717def98c2c5f0d372a435dbac8b7
SHA1

44ecf3a18baedd31631aee41544da693347f5cb8
SHA256

21e1f6ab3dcefd8ec20a425824885a74181f1b3519ceb6933cd14961fef047af
SHA512

90afeb6300fc7d04a93e475fa4aa126ce92526ae7cc1d4ad40c271ad3031f4e6f4af2d4b770aaa7da6378e1a64a26cc342f0f91af900cbce6c0167e5d4cd5ad9
SSDEEP

98304:yu9o6mXa3n8hW6lAhUGopEE5kdmI5bfM4sTmRCuyW6lAheW6lAhMJBAUZL:06R3n8CUGopExfM4nQ0PMJV

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3116	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 3116	1552	rundll32.exe	83
PID 1552 wrote to memory of 3116	1552	rundll32.exe	83
PID 1552 wrote to memory of 3116	1552	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21e1f6ab3dcefd8ec20a425824885a74181f1b3519ceb6933cd14961fef047af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21e1f6ab3dcefd8ec20a425824885a74181f1b3519ceb6933cd14961fef047af.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3116