db321abe2581e524a34dea5741213653412fee9670bda8193cd4becf2d2b3257

Analysis

max time kernel
5s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 20:45

Target

hmjtazq/SkinH_EL.dll
Size

86KB
MD5

8e1ebf661ba3518d4afdf0516308a3ea
SHA1

e56f4de1402d4bdedb492c751cc363eb6e55c360
SHA256

d748b34b19f86aee6f94824eb3a0a1aa7fc0b003e7ad759d224f7b5a2fb870f2
SHA512

96d6744c2f6e5aaa96aa93347a2183092daf4971f74f2e19f29c5277d0d89593df0333ababd89fb32a934488fdb996dddd448a5e3e2270b1a66b793b38c897ec
SSDEEP

1536:eEQMKJNkvpcVcaeLKDbu9l4R2MjHWig0horod35D7lvZZWHmyVClI30QJdrYSXnj:qTNkvp4cgvI4Rpj2+horwNlIUCPJdrpT

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2044	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2044	1780	rundll32.exe	28
PID 1780 wrote to memory of 2044	1780	rundll32.exe	28
PID 1780 wrote to memory of 2044	1780	rundll32.exe	28
PID 1780 wrote to memory of 2044	1780	rundll32.exe	28
PID 1780 wrote to memory of 2044	1780	rundll32.exe	28
PID 1780 wrote to memory of 2044	1780	rundll32.exe	28
PID 1780 wrote to memory of 2044	1780	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hmjtazq\SkinH_EL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hmjtazq\SkinH_EL.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2044

memory/2044-55-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download