2dc4c306da01adebbc2304f3d82d009bc3ca4a097209e4f6dd5400ef4f93cbc8

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 04:54

Target

HShield/AhnUpGS.dll
Size

172KB
MD5

f2a08bcf92b8ddb5676f89cd0babaa45
SHA1

d2e19ecfce47333d0ef6a597c46f6ef0fa0b1199
SHA256

0f7d5fbff4ee279b671bbb9259933b980c7737dce338410bee37b5ec13cf358e
SHA512

501959150e765a3f4074c079f8a5b9b5a044f3899b38b55dc0bfd0bce15a8c6472fe51031a5f751a989d355f9917e57fdf49a04bbee7e569712bc06603169e4c
SSDEEP

3072:jQrqJToUBylyBKhSBpxS5qxq1yx+ri0Q/EPqHaWubIAC6sT34GoxuZl4oQnPRWym:sBUBylyBKhSBpxS5qxq1yxUi0Q/Gq6WB

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

436 rundll32.exe

pid	process
436	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4476 wrote to memory of 436	4476	rundll32.exe	rundll32.exe
PID 4476 wrote to memory of 436	4476	rundll32.exe	rundll32.exe
PID 4476 wrote to memory of 436	4476	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HShield\AhnUpGS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HShield\AhnUpGS.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:436

memory/436-0-0x0000000002950000-0x0000000002973000-memory.dmp

Filesize
140KB

Download
memory/436-4-0x00000000029B0000-0x0000000002A76000-memory.dmp

Filesize
792KB

Download
memory/436-2-0x0000000002980000-0x00000000029A6000-memory.dmp

Filesize
152KB

Download
memory/436-1-0x0000000001010000-0x0000000001025000-memory.dmp

Filesize
84KB

Download