02548db32d3bba029d65fb0d6021bbb8dc9aa787c78d2b191d0c867102e846af

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 10:13

Target

iUjs]pƹuΫ X-Mouse Button Control K��.dll
Size

301KB
MD5

6eeef71b3203e8815614c057fbd6da49
SHA1

0223be8f1f589cee5f44d98ea2581acd05ab2b1a
SHA256

de76e04597d2e937807ffd44f744d15733b85b6679a7d96d5d634c6386cfab71
SHA512

ea73294364fcac57137e9a8ee7e7fb9bd4f8995ad08525dafac343d70b9daf836a3af694cc7797e80a6fef6becd0c58529b1295aed8f46482c78a7d0220216be
SSDEEP

6144:CQBbhIMIfMttz0eNrSyGpomHvVgWAQGiUUYVurwgiCnPK+ETB59RB:CibhA+tz0eNrSyGpomHvqWZGsYVGZnPM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1204 wrote to memory of 1344	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1344	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1344	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1344	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1344	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1344	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1344	1204	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\iUjs]pƹuΫ X-Mouse Button Control K��.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\iUjs]pƹuΫ X-Mouse Button Control K��.dll",#1
  2⤵
  PID:1344

memory/1344-54-0x0000000000000000-mapping.dmp

Download
memory/1344-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download