44bc90b5dc112476c338e2d91ce429405dfb066d20b4b2f62078adc8d6e82355

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 00:15

Target

44bc90b5dc112476c338e2d91ce429405dfb066d20b4b2f62078adc8d6e82355.dll
Size

68KB
MD5

cd9540f9a71f96c53a06a174890ef580
SHA1

2b3edddad866398adb277026cbf4ec1d5b3e8893
SHA256

44bc90b5dc112476c338e2d91ce429405dfb066d20b4b2f62078adc8d6e82355
SHA512

d4bcd03090ca0bfbf2ed665b1e9374e5a82375b9f714e8abf05821a3f47a4133df2480ba505cba36d64f97b0be8084f0e79759c3ca96e53042223445557ee380
SSDEEP

1536:+zfyf1OPhrNBboyp/j/9Ay6952QrAT36yoj/YmHJKoNJBZrzWvg:+zgO3ayhGr2jTqnjXHooNzdzt

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dinerele	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\tiyebuki.dll	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1496	rundll32.exe
1496	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44bc90b5dc112476c338e2d91ce429405dfb066d20b4b2f62078adc8d6e82355.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44bc90b5dc112476c338e2d91ce429405dfb066d20b4b2f62078adc8d6e82355.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:1496

memory/1496-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1496-56-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1496-57-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1496-58-0x0000000000320000-0x00000000003B1000-memory.dmp

Filesize
580KB

Download