ba95cb69fbb45ae79729f3b1d1004df2161e996fc3a9f82170317593af25d4e2

Analysis

max time kernel
31s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:09

Target

ba95cb69fbb45ae79729f3b1d1004df2161e996fc3a9f82170317593af25d4e2.dll
Size

56KB
MD5

c771a8d25fe2a82c89e0d35f3fde5281
SHA1

a43dacddc7779619b7f26266b0b9c8891d9f7912
SHA256

ba95cb69fbb45ae79729f3b1d1004df2161e996fc3a9f82170317593af25d4e2
SHA512

f553adfe0b3ae401b8c9d76c0e9fe43ecd4ff8f5120d67947c83e20194b3d130c09ce291c28bdea0f3cd9aa6f30cc060f9af0615cc7641cec953f1f593614b06
SSDEEP

768:E0EX3DN2zLkgDupilEUY/BuDSHLcKcqNJU0yJssO+wcSDPnGMEaZX:MKrDu8PiuDaBDU0yZGDvlEeX

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

752 rundll32.exe

pid	process
752	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 816 wrote to memory of 752	816	rundll32.exe	rundll32.exe
PID 816 wrote to memory of 752	816	rundll32.exe	rundll32.exe
PID 816 wrote to memory of 752	816	rundll32.exe	rundll32.exe
PID 816 wrote to memory of 752	816	rundll32.exe	rundll32.exe
PID 816 wrote to memory of 752	816	rundll32.exe	rundll32.exe
PID 816 wrote to memory of 752	816	rundll32.exe	rundll32.exe
PID 816 wrote to memory of 752	816	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba95cb69fbb45ae79729f3b1d1004df2161e996fc3a9f82170317593af25d4e2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba95cb69fbb45ae79729f3b1d1004df2161e996fc3a9f82170317593af25d4e2.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:752

memory/752-54-0x0000000000000000-mapping.dmp

Download
memory/752-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/752-56-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download
memory/752-57-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/752-58-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/752-60-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download