2bc78b2cb385b002ee7cf3406e93c7ee336765022f9c3298637dc6496d8fc2fe

Analysis

max time kernel
52s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 19:17

Target

츨12.16ɫ/츨12.16.dll
Size

1.4MB
MD5

fd71f2961edf08926077766be792a64d
SHA1

23f1f94036a9bd97d63bb6094b466354e0e38ce2
SHA256

2a57d00cd493f650cec5735ba7a8110153e8e10348edcdd3589b17714eea27c6
SHA512

f0ab8171c83fcf0e8ed873c9cf342608a93efb8f5550eea0ddbb88e60611177bd303f50fd40a7d7311af35542fc288bf43ef0020fd9c5c913db9b505b89650d3
SSDEEP

24576:xldVgBHgF2S9YUYdKxS5jAzRGzCkReds75oFBug4aRd4Yo4uYFWs7af:x9F2S9YUYdKx5IFReUKMid4Yo4tF77af

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

972 rundll32.exe

pid	process
972	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2028 wrote to memory of 972	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 972	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 972	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 972	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 972	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 972	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 972	2028	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:972

memory/972-54-0x0000000000000000-mapping.dmp

Download
memory/972-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download