8acfefbaf5adaec744052c32781c0ddc0ed486060ce5287cafdfd5b96df50f79

Analysis

max time kernel
51s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 06:00

Target

8acfefbaf5adaec744052c32781c0ddc0ed486060ce5287cafdfd5b96df50f79.dll
Size

53KB
MD5

2f1809bb36603c1ed9ba53e4aa4f8c8a
SHA1

10fe3e1c202fff47067e62c2e8a8146841d90271
SHA256

8acfefbaf5adaec744052c32781c0ddc0ed486060ce5287cafdfd5b96df50f79
SHA512

3c28e676c6ca0419fc4cd0239aa0090dd9605e9d3d1912f83a36dac5db683ea988a584b46ac447cba690e9e1585e81d62b3d0f2b00292a0cfc1f93a9abb67bd8
SSDEEP

768:IhCH+faHIDBYOBC9CbtQEXV1qJe9idhFKEeWlNcCRfSC+9tSCe:WCH+yGC9C+Kit1K+X/aC+9tSCe

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\belamasi	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\tefiwizu.dll	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
520	rundll32.exe
520	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 520	2028	rundll32.exe	28
PID 2028 wrote to memory of 520	2028	rundll32.exe	28
PID 2028 wrote to memory of 520	2028	rundll32.exe	28
PID 2028 wrote to memory of 520	2028	rundll32.exe	28
PID 2028 wrote to memory of 520	2028	rundll32.exe	28
PID 2028 wrote to memory of 520	2028	rundll32.exe	28
PID 2028 wrote to memory of 520	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8acfefbaf5adaec744052c32781c0ddc0ed486060ce5287cafdfd5b96df50f79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8acfefbaf5adaec744052c32781c0ddc0ed486060ce5287cafdfd5b96df50f79.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:520

memory/520-55-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download
memory/520-56-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/520-57-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download