9c8b7f9892b6d6932d5b6c66fca0b0e8a0f7708fd731f54a9b828a34e6dbbf63

Analysis

max time kernel
12s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 17:13

Target

9c8b7f9892b6d6932d5b6c66fca0b0e8a0f7708fd731f54a9b828a34e6dbbf63.dll
Size

198KB
MD5

2859f9b13d4c29c96c06c7fce8df18ef
SHA1

77cfccea15af15c2b05b73c0316181a769a2a668
SHA256

9c8b7f9892b6d6932d5b6c66fca0b0e8a0f7708fd731f54a9b828a34e6dbbf63
SHA512

214cc84e1b88088963db62deac45c2d0e3d9de79ca5cb4857dff650311e68b243673173408d7cf7935c739c036e73f68390c03712e1ffdfe507d024d35333c8f
SSDEEP

3072:6zdHS/h44HWy7pAn96VOPR/DHOjqciTn97VHmgGN7saG40jbtxZj:rQopAIqDOjqciB7VGwzN

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1888	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1888	2016	rundll32.exe	28
PID 2016 wrote to memory of 1888	2016	rundll32.exe	28
PID 2016 wrote to memory of 1888	2016	rundll32.exe	28
PID 2016 wrote to memory of 1888	2016	rundll32.exe	28
PID 2016 wrote to memory of 1888	2016	rundll32.exe	28
PID 2016 wrote to memory of 1888	2016	rundll32.exe	28
PID 2016 wrote to memory of 1888	2016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c8b7f9892b6d6932d5b6c66fca0b0e8a0f7708fd731f54a9b828a34e6dbbf63.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c8b7f9892b6d6932d5b6c66fca0b0e8a0f7708fd731f54a9b828a34e6dbbf63.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1888

memory/1888-55-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download