ed0cbb1c37b4ebb9e8261f5c783ae5fc82f4394324a24967aeec9f9a8179ca3f

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 09:38

Target

ed0cbb1c37b4ebb9e8261f5c783ae5fc82f4394324a24967aeec9f9a8179ca3f.dll
Size

159KB
MD5

0ccfbcc67c84014ac8f67565b69e6590
SHA1

d1a95ebefd40245dcc54f728d1b9bd38db0546cd
SHA256

ed0cbb1c37b4ebb9e8261f5c783ae5fc82f4394324a24967aeec9f9a8179ca3f
SHA512

195b2902c5cb9d9c0b41045f1f26d531db4b6400205b758c12e108a397b76416c19bdb3ff5bc26d62bbcd470d80cb6dd6608229544285c063c3e77df30cde91d
SSDEEP

3072:AVlGRgdcvLXNc+mh4amow4w9JTd9+sbyQWKsOf8HxSGTJ859uNiXPRTVW:VbNnmaamN91d9+sb3WKsOIxtTa58NMRQ

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1224	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1224	1624	rundll32.exe	28
PID 1624 wrote to memory of 1224	1624	rundll32.exe	28
PID 1624 wrote to memory of 1224	1624	rundll32.exe	28
PID 1624 wrote to memory of 1224	1624	rundll32.exe	28
PID 1624 wrote to memory of 1224	1624	rundll32.exe	28
PID 1624 wrote to memory of 1224	1624	rundll32.exe	28
PID 1624 wrote to memory of 1224	1624	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed0cbb1c37b4ebb9e8261f5c783ae5fc82f4394324a24967aeec9f9a8179ca3f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed0cbb1c37b4ebb9e8261f5c783ae5fc82f4394324a24967aeec9f9a8179ca3f.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1224

memory/1224-54-0x0000000000000000-mapping.dmp

Download
memory/1224-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1224-56-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1224-57-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download