02548db32d3bba029d65fb0d6021bbb8dc9aa787c78d2b191d0c867102e846af

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 10:13

Target

iUjs]pƹuΫ X-Mouse Button Control K��.dll
Size

653KB
MD5

f8bc787058a86cc1a02d0bbb42617fef
SHA1

4afa1203013ab9bd0e8c911bd7c807e95ad2520c
SHA256

5eb0ef1e37854750478ca8c6267fb00aa64178088a6cbdcdce67c5b14d8e8959
SHA512

87261e7db4706fed5f23e303777bfc22ac27f64ed09c67eff0beb84010ecdba71c17e8af0da8fad288bd57f361d4d6cab8191719a3984eadf2e33128ff69013e
SSDEEP

12288:7QYkIGSTsIVdEpphhyXhJobUghRvZgAKeMPOML0MWxub8+:7FQIVdEpph0T+UgrZgMMPOML0MW+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2016 wrote to memory of 1080	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1080	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1080	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1080	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1080	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1080	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1080	2016	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\iUjs]pƹuΫ X-Mouse Button Control K��.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\iUjs]pƹuΫ X-Mouse Button Control K��.dll",#1
  2⤵
  PID:1080

memory/1080-54-0x0000000000000000-mapping.dmp

Download
memory/1080-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download