27784f24a8d0b693b96e57355c6eab3e56f2b6909cf74154393fdb6ee9ac6d17

Analysis

max time kernel
69s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 18:37

Target

冰封免费版(请关闭杀毒软件下载)/sky.dll
Size

2.3MB
MD5

4b3997a17c3c356b3c4a964059312ad3
SHA1

6b14988e49a58f48ced59248a41c17c9d6e1c3ef
SHA256

f06dfce697f6caabdd47e5acecd6a116f3fd9e238b2dc2f382077937e194aa7d
SHA512

7105816d6083681cdef6151fce90df2a6b922b5f32a65583006e7f2d3040d6c656e7e0b9d1274c8a5179d353d080fdbf44fb53688d645d71790bb86454d00908
SSDEEP

24576:QkwBweg/qAPbCGbB6NjGdcfibb9ee2Kw29v1oG36MJhBRBmhD9DVdNv6VzGaI+Hv:IMxUO5Ropdl+L4YexzxXG9

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

904 rundll32.exe

pid	process
904	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1140 wrote to memory of 904	1140	rundll32.exe	rundll32.exe
PID 1140 wrote to memory of 904	1140	rundll32.exe	rundll32.exe
PID 1140 wrote to memory of 904	1140	rundll32.exe	rundll32.exe
PID 1140 wrote to memory of 904	1140	rundll32.exe	rundll32.exe
PID 1140 wrote to memory of 904	1140	rundll32.exe	rundll32.exe
PID 1140 wrote to memory of 904	1140	rundll32.exe	rundll32.exe
PID 1140 wrote to memory of 904	1140	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\sky.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\sky.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:904

memory/904-54-0x0000000000000000-mapping.dmp

Download
memory/904-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download