92ead2e4859de6549af1a677aac102edb6e9a5212d47eed51ec3f0cf5c42b89d

Analysis

max time kernel
35s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:01

Target

92ead2e4859de6549af1a677aac102edb6e9a5212d47eed51ec3f0cf5c42b89d.dll
Size

19KB
MD5

c8e56ba1a44ad6ab4e822539f4bbbb30
SHA1

a8015e684826c532d9d15795f1288ed7b4137820
SHA256

92ead2e4859de6549af1a677aac102edb6e9a5212d47eed51ec3f0cf5c42b89d
SHA512

09d34daf008e613034932d60a9b67e1706008f0dfbd9dbe0f59b53b5866d164ac22ceb4e16720ec62572749813f5b89d1780655d4c2e10b99e9d11e5b2730d51
SSDEEP

384:hY7qiys12PwDEVyM8r9fnjOWIo2Mr+bXLe:amFlYRfnjVF2MarK

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1940	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1940	2020	rundll32.exe	28
PID 2020 wrote to memory of 1940	2020	rundll32.exe	28
PID 2020 wrote to memory of 1940	2020	rundll32.exe	28
PID 2020 wrote to memory of 1940	2020	rundll32.exe	28
PID 2020 wrote to memory of 1940	2020	rundll32.exe	28
PID 2020 wrote to memory of 1940	2020	rundll32.exe	28
PID 2020 wrote to memory of 1940	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92ead2e4859de6549af1a677aac102edb6e9a5212d47eed51ec3f0cf5c42b89d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92ead2e4859de6549af1a677aac102edb6e9a5212d47eed51ec3f0cf5c42b89d.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1940

memory/1940-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download