2a3723b950f8331ad2002012fb36e3f1e84b8cd6523b23c67dea35768a8d60fe

Analysis

max time kernel
25s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 01:28

Target

2a3723b950f8331ad2002012fb36e3f1e84b8cd6523b23c67dea35768a8d60fe.dll
Size

960KB
MD5

017662683c8d0ad706a71a1d5034b830
SHA1

2b697af0b54eece79b995d7aa57ed36a4bf85566
SHA256

2a3723b950f8331ad2002012fb36e3f1e84b8cd6523b23c67dea35768a8d60fe
SHA512

8f8954b58254cb0663011b21b02ea1f6bb03d31ace4b17dd6e208c974d566c49564e77f2ec8b334055fce0a28f82f850cd8ab70d9020d5ef03cab6b01a753e88
SSDEEP

24576:Uw5SlJM9VcTvPJMi6XD9i9zU9IOjWcCDUiWBwrksd:Uw5SlJj7BV+g9zdOnCDTpd

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\drivers\kiss.she	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SkinH_EL.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
844	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
844	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 844	2040	rundll32.exe	28
PID 2040 wrote to memory of 844	2040	rundll32.exe	28
PID 2040 wrote to memory of 844	2040	rundll32.exe	28
PID 2040 wrote to memory of 844	2040	rundll32.exe	28
PID 2040 wrote to memory of 844	2040	rundll32.exe	28
PID 2040 wrote to memory of 844	2040	rundll32.exe	28
PID 2040 wrote to memory of 844	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a3723b950f8331ad2002012fb36e3f1e84b8cd6523b23c67dea35768a8d60fe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a3723b950f8331ad2002012fb36e3f1e84b8cd6523b23c67dea35768a8d60fe.dll,#1
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:844

memory/844-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/844-56-0x0000000010000000-0x00000000102E0000-memory.dmp

Filesize
2.9MB

Download
memory/844-61-0x0000000010000000-0x00000000102E0000-memory.dmp

Filesize
2.9MB

Download
memory/844-62-0x0000000010000000-0x00000000102E0000-memory.dmp

Filesize
2.9MB

Download
memory/844-63-0x0000000010000000-0x00000000102E0000-memory.dmp

Filesize
2.9MB

Download