abccd3a8cb58f9d1c2ec92c74a6718ad38c1f78b78aa7872cd161d519a45464d

Analysis

max time kernel
37s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 23:31

Target

abccd3a8cb58f9d1c2ec92c74a6718ad38c1f78b78aa7872cd161d519a45464d.dll
Size

65KB
MD5

6df21314c785440e20e3e0bf931e9db0
SHA1

ebf9946c8d1032f31abce8095fada315bdc5f53f
SHA256

abccd3a8cb58f9d1c2ec92c74a6718ad38c1f78b78aa7872cd161d519a45464d
SHA512

1a0c985e846e1fc1d0ce9579f702fbb4752119577426debc26dff348eb046a5c7ef93aebe08aa2bfdee714d4b2157d10cf2fcaee670343489b807de5240564bc
SSDEEP

1536:MqDlpfQmWM1qqAuIaWModm17Icwa0STVHGDMk1ssGhBW8G:nDmMgqAuDWddhaRu9whZ

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\deluseda	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\medemovo.dll	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1360	rundll32.exe
1360	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\abccd3a8cb58f9d1c2ec92c74a6718ad38c1f78b78aa7872cd161d519a45464d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\abccd3a8cb58f9d1c2ec92c74a6718ad38c1f78b78aa7872cd161d519a45464d.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:1360

memory/1360-55-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1360-56-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1360-57-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/1360-58-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1360-59-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download