81abbe53bb77ff4e8d4d8ff9574e9bc34bde3f136008169565b0b6c7fccc7dc8

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-10-2022 22:03

Target

81abbe53bb77ff4e8d4d8ff9574e9bc34bde3f136008169565b0b6c7fccc7dc8.dll
Size

920KB
MD5

8eb670177eef9ffbf64e799c5646664f
SHA1

6191803642d8fdc83b84ef73ab2ea70d9083ee9c
SHA256

81abbe53bb77ff4e8d4d8ff9574e9bc34bde3f136008169565b0b6c7fccc7dc8
SHA512

484b29ea30d78e584d57978e8b98eb8deef57e91db21549b0bc02c010a62ad5a4885279a9eee32f5d7c58b896922a547bdf4438646a0c670b7ad9bebbb1f6227
SSDEEP

12288:1iCT4Jjh2Gkx5ZJGomRFpDogyGoQOlXYneozxJgQx/7Jrv:1nMjMGO5WhFto/IeolJggFv

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1176	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\81abbe53bb77ff4e8d4d8ff9574e9bc34bde3f136008169565b0b6c7fccc7dc8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\81abbe53bb77ff4e8d4d8ff9574e9bc34bde3f136008169565b0b6c7fccc7dc8.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1176

memory/1176-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download