af87d20283c5cec59051cb75b19d7334fab9e724bfdda24a3c93890d34bd9f33

Analysis

max time kernel
41s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:53

Target

af87d20283c5cec59051cb75b19d7334fab9e724bfdda24a3c93890d34bd9f33.dll
Size

45KB
MD5

918f030779d3bf2fa9daf1e774ca9339
SHA1

fe82391897fe5f83cfd187b62dd9e2e300648023
SHA256

af87d20283c5cec59051cb75b19d7334fab9e724bfdda24a3c93890d34bd9f33
SHA512

58b5d24f80f62e73418be640058884a6a67318553cdb9289041807ff10678d39f3d31f988339ee1c683b91e8e2c32f96a015797d286795eafd367e70dfe7535e
SSDEEP

768:awk1ODTj4q8t9K5jTQfbUT2cwn19Mb7SZsLawBR241lsIwq4Ox2ly:alIHj+qjcDUT2fvmW+2wr2KAq4Ox2k

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

980 rundll32.exe

pid	process
980	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2024 wrote to memory of 980	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 980	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 980	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 980	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 980	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 980	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 980	2024	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af87d20283c5cec59051cb75b19d7334fab9e724bfdda24a3c93890d34bd9f33.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af87d20283c5cec59051cb75b19d7334fab9e724bfdda24a3c93890d34bd9f33.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:980

memory/980-54-0x0000000000000000-mapping.dmp

Download
memory/980-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download