6acc1c7e0ecca172fbccf4afa293d0366f40df60b27bed0a48fec06de2c2fada

Analysis

max time kernel
79s
max time network
121s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 07:34

Target

6acc1c7e0ecca172fbccf4afa293d0366f40df60b27bed0a48fec06de2c2fada.dll
Size

215KB
MD5

1a8cf16a85361aa8cc2d140347b1dd79
SHA1

bc0d4e5fffc7bcc8c34ce4c90ba2a08412b582b2
SHA256

6acc1c7e0ecca172fbccf4afa293d0366f40df60b27bed0a48fec06de2c2fada
SHA512

281302a35e03430f299d75b9049cbdcc36ff5e09d733b098d656ddc5ceefd4109e86ec77be8fd4b1ad51ab03d320437a87630cf084f7bf5e9fb865e7ee84a228
SSDEEP

3072:JmZg+h/VgSUajU3XbZFHQY+hSZ7KYwIHPrJxSgUPeMY1+Ns5t8Lv0cW4CFUXv/R7:JmZg+CajU3LH+hqKYw4xieMYz8YlQr

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
848	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27
PID 1776 wrote to memory of 848	1776	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6acc1c7e0ecca172fbccf4afa293d0366f40df60b27bed0a48fec06de2c2fada.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6acc1c7e0ecca172fbccf4afa293d0366f40df60b27bed0a48fec06de2c2fada.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:848

memory/848-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/848-56-0x0000000000170000-0x0000000000195000-memory.dmp

Filesize
148KB

Download
memory/848-57-0x0000000000380000-0x00000000003B8000-memory.dmp

Filesize
224KB

Download