de8c6f8ac6f3a7c9f0b317e3781c97d95f975b6f4a1008b308ce8c86efd30391

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
10-10-2022 21:26

Target

de8c6f8ac6f3a7c9f0b317e3781c97d95f975b6f4a1008b308ce8c86efd30391.dll
Size

1.5MB
MD5

e60652918bd53d278637593128e47677
SHA1

7382c810fdcbd8a66d0646ab53123640dfdd14fd
SHA256

de8c6f8ac6f3a7c9f0b317e3781c97d95f975b6f4a1008b308ce8c86efd30391
SHA512

a7fe852ec5daac7980ed79deb0d65c7ebbf7af4c8b4249a71ae8b18e7c4086dd0adb13c01a0eda7645ab36f9afb5ecc9d4d16ee481c57afa75167b05e8dc11a6
SSDEEP

24576:2AabTtjbIxhh8LvVzd7JxHNfFwZh5/vOQ21vG3AcyG:2AxWVzZrbRVuyG

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
848	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 848	1264	rundll32.exe	27
PID 1264 wrote to memory of 848	1264	rundll32.exe	27
PID 1264 wrote to memory of 848	1264	rundll32.exe	27
PID 1264 wrote to memory of 848	1264	rundll32.exe	27
PID 1264 wrote to memory of 848	1264	rundll32.exe	27
PID 1264 wrote to memory of 848	1264	rundll32.exe	27
PID 1264 wrote to memory of 848	1264	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de8c6f8ac6f3a7c9f0b317e3781c97d95f975b6f4a1008b308ce8c86efd30391.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de8c6f8ac6f3a7c9f0b317e3781c97d95f975b6f4a1008b308ce8c86efd30391.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:848

memory/848-54-0x0000000000000000-mapping.dmp

Download
memory/848-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download