b2d67f85171a7e394f28cc8df0f0a36f80e7fb7aeada7f9709fd1543b53e4579

Resubmissions

25/06/2024, 17:24

max time kernel
592s
max time network
602s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 17:24

Target

Arquivos Minecraft/UnlockerPortable/App/Unlocker/UnlockerHook.dll
Size

4KB
MD5

abbee3e367f6e6ed415d33c78121ffa9
SHA1

72ed524e769a9f8e72804c019a1cbf58f0d305a7
SHA256

af36ab81c5befe41140a5da5f605361be18b55d6410da1cbf1bf7e0dcf52bc92
SHA512

a01c955f3f60325c4aba28ea6c4c8c0d9f0b1a46928fccb37d38ad676eeaee8814fb15ca15ccb79739d63802bd850940e365cf542d2de1381276d22796f62c63
SSDEEP

48:C5H6MDvlw43mN6MJmxolFuTUyJaeGA9TKziUFvQ4wZK0E8ee1kAosky4+q+O:AH1ln4J9FwzKBkEtjJ+DO

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1196	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1196	864	rundll32.exe	92
PID 864 wrote to memory of 1196	864	rundll32.exe	92
PID 864 wrote to memory of 1196	864	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Arquivos Minecraft\UnlockerPortable\App\Unlocker\UnlockerHook.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Arquivos Minecraft\UnlockerPortable\App\Unlocker\UnlockerHook.dll",#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4268 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:4684