1112aaf76c42516d8f2778d2f19a84a75cd778e2b9d968fbf5c06e934e33a9e9

Analysis

max time kernel
134s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:35

Target
1112aaf76c42516d8f2778d2f19a84a75cd778e2b9d968fbf5c06e934e33a9e9.dll
Size 1.4MB
Sample240603-nqfc5aed25
SHA256 1112aaf76c42516d8f2778d2f19a84a75cd778e2b9d968fbf5c06e934e33a9e9
MD5 2402a5098401f0478af02494009bb979
SHA1 14d61479dd12f90a88ef371605d93c1f178e45c7
SHA512 6ba5b9d215198f536a0abd0485ff0e046765dc01a39f0a016a5e23bc25a969f47561d74df5e799f5f97374546c917d47df5bb91e54883e6e918aca5550f942c6
SSDEEP 24576:MrzfPXCsRaYAM/lfkykiMh9M0Wj2XugCAYph/pprwtpp+vpzppmppa59XcuS/zbl:MrusRDAMNMh9M0u2utxW
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1616	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 1616	928	rundll32.exe	83
PID 928 wrote to memory of 1616	928	rundll32.exe	83
PID 928 wrote to memory of 1616	928	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1112aaf76c42516d8f2778d2f19a84a75cd778e2b9d968fbf5c06e934e33a9e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1112aaf76c42516d8f2778d2f19a84a75cd778e2b9d968fbf5c06e934e33a9e9.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1616

memory/1616-0-0x0000000010000000-0x0000000010181000-memory.dmp

Download