7f47f4592986a54d7762affbf009c94fc2cd7895ec749a6864be997c809d3c80

Analysis

max time kernel
30s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08/01/2023, 17:11

Target

7f47f4592986a54d7762affbf009c94fc2cd7895ec749a6864be997c809d3c80.dll
Size

2.7MB
MD5

06a25bf5ee61e4578675096998d012f3
SHA1

1afc40cb52a93183137a9674a54be434f09c6946
SHA256

7f47f4592986a54d7762affbf009c94fc2cd7895ec749a6864be997c809d3c80
SHA512

2838f6631a265fbcf76c0067313b10399adb2997a4d1e9daa31cf2abe114646063c3bbfae0e1939ea2d4afd448ad341249a140fd61dccf204eeaf378bde5fdf0
SSDEEP

49152:MgyTLLAFH1blsA4kt4UDm6PTTwbYNxgwWArexvq6CXot4brpeAyjP/lR:LyTw7sAd9vTmqxXWcwS6CX+4bFeAyLv

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	1788	rundll32.exe
3	1788	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1788	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1788	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1788	940	rundll32.exe	28
PID 940 wrote to memory of 1788	940	rundll32.exe	28
PID 940 wrote to memory of 1788	940	rundll32.exe	28
PID 940 wrote to memory of 1788	940	rundll32.exe	28
PID 940 wrote to memory of 1788	940	rundll32.exe	28
PID 940 wrote to memory of 1788	940	rundll32.exe	28
PID 940 wrote to memory of 1788	940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f47f4592986a54d7762affbf009c94fc2cd7895ec749a6864be997c809d3c80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f47f4592986a54d7762affbf009c94fc2cd7895ec749a6864be997c809d3c80.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:1788

memory/1788-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1788-56-0x0000000074B30000-0x00000000754ED000-memory.dmp

Filesize
9.7MB

Download
memory/1788-57-0x0000000073890000-0x000000007424D000-memory.dmp

Filesize
9.7MB

Download
memory/1788-58-0x0000000074B30000-0x00000000754ED000-memory.dmp

Filesize
9.7MB

Download
memory/1788-59-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1788-60-0x0000000074B30000-0x00000000754ED000-memory.dmp

Filesize
9.7MB

Download
memory/1788-61-0x0000000073890000-0x000000007424D000-memory.dmp

Filesize
9.7MB

Download