aff602b21dbd4e51834bccc40e7438a7bd5fd3a572775c5072287f69f67c0679

Analysis

max time kernel
2s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 06:52

Target

aff602b21dbd4e51834bccc40e7438a7bd5fd3a572775c5072287f69f67c0679.dll
Size

107KB
MD5

e2d95e05ed451d78d48cb4fa584f029a
SHA1

f7f723f588e07cc34ff268506a9616ffcedab212
SHA256

aff602b21dbd4e51834bccc40e7438a7bd5fd3a572775c5072287f69f67c0679
SHA512

f2572a78ff36b094a0bfb00416067cbf250602b854ad9a40a8cf40be43572a8d49a7247c4b4a424874511cbbce521577e7bbc0e657edd09c0ae2a0972b888a3d
SSDEEP

3072:JTaSxXgNRryPKUjblIIAVEqDzH3KzJ1Huw:JTFXIGPZb2E23O1Ht

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1512	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1512	1648	rundll32.exe	28
PID 1648 wrote to memory of 1512	1648	rundll32.exe	28
PID 1648 wrote to memory of 1512	1648	rundll32.exe	28
PID 1648 wrote to memory of 1512	1648	rundll32.exe	28
PID 1648 wrote to memory of 1512	1648	rundll32.exe	28
PID 1648 wrote to memory of 1512	1648	rundll32.exe	28
PID 1648 wrote to memory of 1512	1648	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aff602b21dbd4e51834bccc40e7438a7bd5fd3a572775c5072287f69f67c0679.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aff602b21dbd4e51834bccc40e7438a7bd5fd3a572775c5072287f69f67c0679.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1512

memory/1512-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1512-57-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/1512-56-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download