e60400f9da142b7bb4e83bfa2d964e3ed937dd350d2c6881c21daa826757bac3

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18/12/2022, 20:31

Target
SecuriteInfo.com.Win32.Evo-gen.26930.13860.dll
Size 732KB
Sample221218-zapseagf71
SHA256 e60400f9da142b7bb4e83bfa2d964e3ed937dd350d2c6881c21daa826757bac3
MD5 67b66d389eef5e61d46e14afccf978db
SHA1 18449b4d78265f2cd5510102bd72e616d2d37f23
SHA512 1c5aa582952667adb1acaeb24f27707d3a13990dc45731389aa9206ec5d78d8fb68822cc9192e11a6e2a369dd741ee09b40d9f278ca72481c3c5afb8f93122a7
SSDEEP 6144:na5MhNqhWf+Yl2l2Ly1wIYUzKxWWd0d4MuM2KfhK7gk0wzeBiUlzBeN+aYkyLVSP:na5MhNaWfBqcIWqim7s7Hc/p2QLVy
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2036	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2036	840	rundll32.exe	28
PID 840 wrote to memory of 2036	840	rundll32.exe	28
PID 840 wrote to memory of 2036	840	rundll32.exe	28
PID 840 wrote to memory of 2036	840	rundll32.exe	28
PID 840 wrote to memory of 2036	840	rundll32.exe	28
PID 840 wrote to memory of 2036	840	rundll32.exe	28
PID 840 wrote to memory of 2036	840	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.26930.13860.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.26930.13860.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2036

memory/2036-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Download