e77d6aad20b5587dfb7e83f691131342673c47cbdbbb627b894c050820a63244

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/01/2023, 22:38

Target

BlueSoleil 1.6.1.1 official release/language/0007-German/btpcfg.dll
Size

284KB
MD5

0fff2c7dcebd6e4f47c2f68a29e88e21
SHA1

121a77846a460936158981ecf6e3a4643ae3afe8
SHA256

57060626359b4bf2620a1ab38eb0a8e1032da7688efe6da4c39f237dad8db4e8
SHA512

0bf0f9192177ae6aeaf87ca4daa08931033cdd91cf7fd44cd933cedfb206e31900f9825d990d299fb5354ffa06685b7d25517e90cd1a2b440826dca7c491fa2f
SSDEEP

3072:D3YPxrhRdVQYypwAZw+6ZbNk9SMvjtXCxn7HBg4+yhrSfQbzhvORMYpVfhW8llUb:sPxrhHVFypwAZw7Z+vQlGRSEQ+Z

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1268	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1268	1696	rundll32.exe	27
PID 1696 wrote to memory of 1268	1696	rundll32.exe	27
PID 1696 wrote to memory of 1268	1696	rundll32.exe	27
PID 1696 wrote to memory of 1268	1696	rundll32.exe	27
PID 1696 wrote to memory of 1268	1696	rundll32.exe	27
PID 1696 wrote to memory of 1268	1696	rundll32.exe	27
PID 1696 wrote to memory of 1268	1696	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BlueSoleil 1.6.1.1 official release\language\0007-German\btpcfg.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BlueSoleil 1.6.1.1 official release\language\0007-German\btpcfg.dll",#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1268

memory/1268-55-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download