2bb3bd027206f7a549c47feabd1ec880c4cf6aa90c3befe213a45d8372897913

Analysis

max time kernel
26s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-10-2022 20:43

Target

2bb3bd027206f7a549c47feabd1ec880c4cf6aa90c3befe213a45d8372897913.dll
Size

3.0MB
MD5

e2cf78cd4c8bdfe435a4adca8b2da51c
SHA1

6d186ba360876073bdce6b8e489829360f3f2431
SHA256

2bb3bd027206f7a549c47feabd1ec880c4cf6aa90c3befe213a45d8372897913
SHA512

f2ab8e347a09ee5d8a02f6227cb5da34da927d4c40d1b6ae5f20b2c118ce436f0567227f3afe09388f23d6d834da00efe897105ecc370f61a7762c0da79465c0
SSDEEP

49152:NOLmDDsmL+nzn2wiCLjcNAtJxE8f+s8KuqGaX0ToIBAUZLYcce:gSDYmqKwrLjhfW3JBAUZLTc

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1776	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1776	1508	rundll32.exe	27
PID 1508 wrote to memory of 1776	1508	rundll32.exe	27
PID 1508 wrote to memory of 1776	1508	rundll32.exe	27
PID 1508 wrote to memory of 1776	1508	rundll32.exe	27
PID 1508 wrote to memory of 1776	1508	rundll32.exe	27
PID 1508 wrote to memory of 1776	1508	rundll32.exe	27
PID 1508 wrote to memory of 1776	1508	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bb3bd027206f7a549c47feabd1ec880c4cf6aa90c3befe213a45d8372897913.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bb3bd027206f7a549c47feabd1ec880c4cf6aa90c3befe213a45d8372897913.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1776

memory/1776-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download