9b0e3f676d8db16a09b3e1aba66d8400db2f6e25fadccdb5bd5dd5f10c244535

Analysis

max time kernel
232s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:52

Target

x64.dll
Size

14.5MB
MD5

3bd5aea364326cdfa667651a93e7a4c9
SHA1

f33b4a83e038363c1a4df919e6f6e0e41dba9334
SHA256

23f04ba936568e9a7c9dce7a6beb52c9be7eb13b734cd390c99e7546cbe1973d
SHA512

7bd4e742b4d683b79de54eaf7d8b215252212921b8a53d1fbfc8e51ce43505c003da62fd126663bc04bbc65b8f77b85232c78ea6ecba8a4e425c28c0e9c80dc3
SSDEEP

393216:00Rly5ZnSHLe1tvwDTtwJuefdrX780dNYbg4A358TjGNrS1aKbBICZBSJLGWIGC2:NRlyP71tvwDTtwJuefdrX780dNYbg4Az

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1480 rundll32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

rundll32.exe

pid process

1480 rundll32.exe
1480 rundll32.exe
1480 rundll32.exe

pid	process
1480	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 580 wrote to memory of 1480	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1480	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1480	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1480	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1480	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1480	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1480	580	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:580

memory/1480-54-0x0000000000000000-mapping.dmp

Download
memory/1480-55-0x0000000076221000-0x0000000076223000-memory.dmp

Filesize
8KB

Download