6dbeebffd9de2d1c6c10c7d2bbc221dccf92b8ee4a203f5761d1343e34436a61

Analysis

max time kernel
36s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 09:45

Target

츨11.27ɫ/츨11.27.dll
Size

1.4MB
MD5

5292dd08cc360231e91320d2599c5c8a
SHA1

caf0bd247c4c4d73854ba6c852ee97ce46cf4949
SHA256

0d08a63a51270608424655e58669b4e843062a18e8eb97b232401ff3bd3510c9
SHA512

ce86e3433d5857981419cf46b8bceae63570406938397acfc8f845eca99e89c654ec4d973a89b0d11a9c39ee1d9ebb5dbc33f906c89207970760c4223a781077
SSDEEP

24576:/3//MJCTzF2S9rfY3Lxn8EacxRabl+dbl3rw3nk6aju8Yovco4Jc2af:/3bF2S9rfY3Lx1XRSl+/E3Ku8Yov4Raf

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1648 rundll32.exe

pid	process
1648	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 780 wrote to memory of 1648	780	rundll32.exe	rundll32.exe
PID 780 wrote to memory of 1648	780	rundll32.exe	rundll32.exe
PID 780 wrote to memory of 1648	780	rundll32.exe	rundll32.exe
PID 780 wrote to memory of 1648	780	rundll32.exe	rundll32.exe
PID 780 wrote to memory of 1648	780	rundll32.exe	rundll32.exe
PID 780 wrote to memory of 1648	780	rundll32.exe	rundll32.exe
PID 780 wrote to memory of 1648	780	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:1648

memory/1648-54-0x0000000000000000-mapping.dmp

Download
memory/1648-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download