6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 12:12

Target
MouseHook.dll
Size 32KB
Sample240616-pdbpvasfph
SHA256 93a9a7fd3e263959a0d6a19936300b3ce25bf528f49a687e385a6ad168dedb69
MD5 65e642f3bb79e29178688872b4a10110
SHA1 46c97a21de9823b2f7b72f6498da2be29168716c
SHA512 ffa95cc5ed5f39c58a5c75e7b82f98a9570babc1fefdb43af835f4b8176ccc54a263ea51600bc8e3447b7d432f6f571115ddebd9933f4098d9de9fbf32b9a3d6
SSDEEP 768:PHr78zW8XvCBcaxXoAapGai292OKqFqRt7+Bq:PL78zW8fCWa9C2OKqFI7Sq
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 2368	940	rundll32.exe	83
PID 940 wrote to memory of 2368	940	rundll32.exe	83
PID 940 wrote to memory of 2368	940	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MouseHook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MouseHook.dll,#1
  2⤵
  PID:2368