c5977998b59d68ee158750de123e3079c17a4955dd313f50b51384ec6d656371

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 18:05

Target

c5977998b59d68ee158750de123e3079c17a4955dd313f50b51384ec6d656371.dll
Size

3.6MB
MD5

5d13be58c8b84d20fc6b174adb0d7fd2
SHA1

296bd5773cca82e1ae296091ec59749b6639ef86
SHA256

c5977998b59d68ee158750de123e3079c17a4955dd313f50b51384ec6d656371
SHA512

57367591dc5b53cb32c0fddd196020e275cad26873644954343be2696cec877a20b7ea64560ea6c6c6293d18a7fbc7558fa59934db37e3d5d01d6152d69eb2c8
SSDEEP

49152:WXkKSKW4We1jKEGgPKfzU5R5+CAO9wnFoQqkyKHqGZtzp860YOXeD9TNe1:lXKW4WeZLBKo5R5+6kPqkoG7a60tX

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3848	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 3848	380	rundll32.exe	91
PID 380 wrote to memory of 3848	380	rundll32.exe	91
PID 380 wrote to memory of 3848	380	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5977998b59d68ee158750de123e3079c17a4955dd313f50b51384ec6d656371.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5977998b59d68ee158750de123e3079c17a4955dd313f50b51384ec6d656371.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:4140