350d24458cb7271912cdafc2fba3dd90fa7c9b3fc6490d8c2d5199687e80150a

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 20:29

Target

350d24458cb7271912cdafc2fba3dd90fa7c9b3fc6490d8c2d5199687e80150a.dll
Size

3.2MB
MD5

5178355e31027b469b567fc6d9cce724
SHA1

c6fc9b5d3ed3639b070d42993a37c62cc9f20fe8
SHA256

350d24458cb7271912cdafc2fba3dd90fa7c9b3fc6490d8c2d5199687e80150a
SHA512

d09142d3a2243f5db6faa0878e9530d0ac8bb5ea88e3eb54bcf2c529858653b2302cfaf043fd70a27cf486eb599b8f23cb781d1efcf2130a2f71b372e283ec65
SSDEEP

49152:iI9yfJnmqWoKQJI/9+s8KuqGaX0ToIBAUZLY/eCt:f9qJnwoKuIOJBAUZLr

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1360	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 1360	3772	rundll32.exe	80
PID 3772 wrote to memory of 1360	3772	rundll32.exe	80
PID 3772 wrote to memory of 1360	3772	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\350d24458cb7271912cdafc2fba3dd90fa7c9b3fc6490d8c2d5199687e80150a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\350d24458cb7271912cdafc2fba3dd90fa7c9b3fc6490d8c2d5199687e80150a.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1360