2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50

Analysis

max time kernel
148s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 19:53

Target

2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50.dll
Size

612KB
MD5

bba63b02068f72bb9338db22c470b2ed
SHA1

36c115e8bc3a817a6bd2a6105fe3f3b7f6b735ac
SHA256

2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50
SHA512

eb757ff55f8e1a8ebcf2757912381aa64626ea4fd5af3fdcb05256f120c7f68ac0ff6016044629cb8ed52886492bd387644400a2f143a4ff54e95e6a8c92d21c
SSDEEP

6144:YYHojk/imorOWn47GxtRFSFEogZvxiVDYBKcTDZ5K1BMCkUlxgByAMGByNr2nq:VIZmorznxxtRF6eFBXXK8mxgBIyq

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3728	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 3728	3052	rundll32.exe	82
PID 3052 wrote to memory of 3728	3052	rundll32.exe	82
PID 3052 wrote to memory of 3728	3052	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3728

memory/3728-3-0x000000007620D000-0x000000007620E000-memory.dmp

Filesize
4KB

Download
memory/3728-4-0x00000000761F0000-0x00000000762E0000-memory.dmp

Filesize
960KB

Download
memory/3728-5-0x00000000761F0000-0x00000000762E0000-memory.dmp

Filesize
960KB

Download
memory/3728-6-0x00000000761F0000-0x00000000762E0000-memory.dmp

Filesize
960KB

Download