36b960e07be05f7ef8944516166099b98eceda66bf4f884d46761cb02700af00

Analysis

max time kernel
37s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:52

Target

36b960e07be05f7ef8944516166099b98eceda66bf4f884d46761cb02700af00.dll
Size

56KB
MD5

b4e81df73b1f50be2211dffd7d36a15f
SHA1

27cacdc81cbe6d61182e153abbc30d3831c9c855
SHA256

36b960e07be05f7ef8944516166099b98eceda66bf4f884d46761cb02700af00
SHA512

21a13f95b492d042586ee4cdaad53d99624059a0c651ff231ea4b061ec60ba0dd14a53db91fc5b8b46cd1277f3fa822442863bec89fc5b9c342c6a699e312e15
SSDEEP

384:fP0P//K9Wsd+/kto2EDCSqgpPJPKj/JcCcgONER+WxgqClRgVA3RTJr4UgIeupOP:f8P/nsP/gGjyCENggqClRgAziZ1tVtx

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1992 rundll32.exe

pid	process
1992	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1960 wrote to memory of 1992	1960	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 1992	1960	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 1992	1960	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 1992	1960	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 1992	1960	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 1992	1960	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 1992	1960	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36b960e07be05f7ef8944516166099b98eceda66bf4f884d46761cb02700af00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36b960e07be05f7ef8944516166099b98eceda66bf4f884d46761cb02700af00.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:1992

memory/1992-54-0x0000000000000000-mapping.dmp

Download
memory/1992-55-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download