b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73

Analysis

max time kernel
141s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 04:33

Target

SystemClockHook.dll
Size

221KB
MD5

a7d86ed5997983ec1f994ac6db0f9528
SHA1

698b6a99c3d6fab20213b70be2f865fcf04cbd1d
SHA256

6c8bcc59b466e3562f067c9818d41a3cfb3c3a16a0087f1c3b01d0dcccf7cbf2
SHA512

852f69b3c0c28c733e9c05e20ece0837a07ee96b07f042b84a8c6d410e55e8e83d49918c08ed237fa06440cd370bcd460dbcf8a2fe6141a709dc681469452e0b
SSDEEP

3072:c0EoPvvwCwQC2mCGxVBuQa3v90q68JSrfgIwt30yq8LJ3UCMucUYmPhmdV/mYtdY:HEovwCWG3VZFSzgJUGK2rOPJ9

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1528 rundll32.exe

pid	process
1528	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4748 wrote to memory of 1528	4748	rundll32.exe	rundll32.exe
PID 4748 wrote to memory of 1528	4748	rundll32.exe	rundll32.exe
PID 4748 wrote to memory of 1528	4748	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SystemClockHook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4748

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SystemClockHook.dll,#1
2⤵
- Suspicious use of FindShellTrayWindow
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:1892