337d8f8afa16780a821bc1c9f094dd7302c5fd9e1edd470920b6df47ed46bdbf

Analysis

max time kernel
27s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 21:15

Target

337d8f8afa16780a821bc1c9f094dd7302c5fd9e1edd470920b6df47ed46bdbf.dll
Size

652KB
MD5

0ddf47e2a81e071c8c02d068efb6dc10
SHA1

4c8eba6c375df154171c8174a3448e982edf371c
SHA256

337d8f8afa16780a821bc1c9f094dd7302c5fd9e1edd470920b6df47ed46bdbf
SHA512

0de2fd56fd2a965496299c492494ae74c6cb8e540ab0c96b89b4cf6290cbf44701629ccac3c16cbcc5f08a623d0d77aa8898cba2d5ba87b65d40e401e3680744
SSDEEP

6144:ryFWeVNzYakPdVsveysoChHStLoQ4oRvsY9hckEWJroTNpcAup3pIKonIQJNd:ryFWeV8PdcrsoChyd3UJWKTkJVuHd

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1492	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1492	1940	rundll32.exe	17
PID 1940 wrote to memory of 1492	1940	rundll32.exe	17
PID 1940 wrote to memory of 1492	1940	rundll32.exe	17
PID 1940 wrote to memory of 1492	1940	rundll32.exe	17
PID 1940 wrote to memory of 1492	1940	rundll32.exe	17
PID 1940 wrote to memory of 1492	1940	rundll32.exe	17
PID 1940 wrote to memory of 1492	1940	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\337d8f8afa16780a821bc1c9f094dd7302c5fd9e1edd470920b6df47ed46bdbf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\337d8f8afa16780a821bc1c9f094dd7302c5fd9e1edd470920b6df47ed46bdbf.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1492

memory/1492-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download