be9d5491ecad89e42794ff9464fda2d5e1175e446d5cecdfab0a809d018cbbef

Analysis

max time kernel
42s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 16:38

Target

be9d5491ecad89e42794ff9464fda2d5e1175e446d5cecdfab0a809d018cbbef.dll
Size

1015KB
MD5

9e79547a99e38f980655e6c990c91f4f
SHA1

934f320d7207e968e512404b8196a98c7777ed18
SHA256

be9d5491ecad89e42794ff9464fda2d5e1175e446d5cecdfab0a809d018cbbef
SHA512

dd9f4b1ca8dedf6cfa292ea4a80f0a16556024746f7fd48c97a30aab242fc92b495461e98c26a60328aa7f59a397444c1be576ec56b8a2c380819b2a4064d9f9
SSDEEP

24576:D+qG125uehjjeV/qzB/CNNxjEpwVi/v5OjWcCDUiWBwrkZ:22jk/qzsNLjLin5OnCDTo

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\drivers\kiss.she	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SkinH_EL.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1736	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1736	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1736	1380	rundll32.exe	23
PID 1380 wrote to memory of 1736	1380	rundll32.exe	23
PID 1380 wrote to memory of 1736	1380	rundll32.exe	23
PID 1380 wrote to memory of 1736	1380	rundll32.exe	23
PID 1380 wrote to memory of 1736	1380	rundll32.exe	23
PID 1380 wrote to memory of 1736	1380	rundll32.exe	23
PID 1380 wrote to memory of 1736	1380	rundll32.exe	23

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be9d5491ecad89e42794ff9464fda2d5e1175e446d5cecdfab0a809d018cbbef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\be9d5491ecad89e42794ff9464fda2d5e1175e446d5cecdfab0a809d018cbbef.dll,#1
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1736

memory/1736-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1736-56-0x0000000010000000-0x000000001030E000-memory.dmp

Filesize
3.1MB

Download
memory/1736-57-0x0000000010000000-0x000000001030E000-memory.dmp

Filesize
3.1MB

Download
memory/1736-58-0x0000000010000000-0x000000001030E000-memory.dmp

Filesize
3.1MB

Download
memory/1736-59-0x0000000010000000-0x000000001030E000-memory.dmp

Filesize
3.1MB

Download
memory/1736-60-0x0000000010000000-0x000000001030E000-memory.dmp

Filesize
3.1MB

Download