3b6c580bd6ce1499473d35c88772895514e622b148f18f75797e85f5d553a395

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:30

Target
3b6c580bd6ce1499473d35c88772895514e622b148f18f75797e85f5d553a395.dll
Size 2.9MB
Sample240603-nl4j6aeb69
SHA256 3b6c580bd6ce1499473d35c88772895514e622b148f18f75797e85f5d553a395
MD5 1d4102ff4a909b21d9b8e3d1f4c7843a
SHA1 24f7bf77460082fc66225f8277975225040692b0
SHA512 03851e9b9b04ad7e42d7b8051daf0ad0091e82efe51380331ec419f1f689f4d2091fc82fb3b060b9ac8442815dde8b3c91a9b754a38b39b3ef1d65b7cd21be43
SSDEEP 24576:HPL03pnIy55bbiFR5arPp5QkeMUk0u83lFh/etagRP5VBqCcKPly3s7J9sVphakt:HIpn/pQFFUvRP5H+KD7Ja/PsvVf0oAd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of SetWindowsHookEx 10 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 4340	4404	rundll32.exe	83
PID 4404 wrote to memory of 4340	4404	rundll32.exe	83
PID 4404 wrote to memory of 4340	4404	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b6c580bd6ce1499473d35c88772895514e622b148f18f75797e85f5d553a395.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b6c580bd6ce1499473d35c88772895514e622b148f18f75797e85f5d553a395.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4340

memory/4340-16-0x00000000023C0000-0x00000000023C1000-memory.dmp

Download

memory/4340-15-0x00000000023C0000-0x00000000023C1000-memory.dmp

Download

memory/4340-17-0x00000000023C0000-0x00000000023C1000-memory.dmp

Download

memory/4340-18-0x00000000023C0000-0x00000000023C1000-memory.dmp

Download