04d6549d80d4a6f9611ca97b6d66ddffcc2a4339aa34f34a2c9c9a7518f0f628

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 17:27

Target

04d6549d80d4a6f9611ca97b6d66ddffcc2a4339aa34f34a2c9c9a7518f0f628.dll
Size

6.3MB
MD5

4adece8944ccd71ed1f68c5242765581
SHA1

f4d2d21c280bd765fa8cbf132ceb8070f814dae2
SHA256

04d6549d80d4a6f9611ca97b6d66ddffcc2a4339aa34f34a2c9c9a7518f0f628
SHA512

3ddfffc47e23f1b8155f4ad006573b7e39f54cd7239ef2866b31d220978bed8e6347f7386daa7fd20788d2c05f25ea4be00ee36a2389982a3a0e64b48f035e41
SSDEEP

98304:14gOl0D01PL8HWOzX6rpDscAgRSix6bZ:14yD01PL82OzX6lS

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1232	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1232	4272	rundll32.exe	82
PID 4272 wrote to memory of 1232	4272	rundll32.exe	82
PID 4272 wrote to memory of 1232	4272	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04d6549d80d4a6f9611ca97b6d66ddffcc2a4339aa34f34a2c9c9a7518f0f628.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04d6549d80d4a6f9611ca97b6d66ddffcc2a4339aa34f34a2c9c9a7518f0f628.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1232