16b3a9a856b88840c26c897f8f2c0742a9947b237f39d40c8abcebb57cca4bcb

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09-01-2023 20:06

Target

16b3a9a856b88840c26c897f8f2c0742a9947b237f39d40c8abcebb57cca4bcb.dll
Size

980KB
MD5

0e28d5c53dede4241586632b8ce021af
SHA1

207138d47dfdab1a83e1ae8a1b18f2227973efb1
SHA256

16b3a9a856b88840c26c897f8f2c0742a9947b237f39d40c8abcebb57cca4bcb
SHA512

a0b4ba69fb4920df045127929b551d8a7710aafa664a4ab39662ffab641a94dbded9f318882b28088c87207555e0efe85911def63f60de5ca94bf89d1a08e637
SSDEEP

12288:kEFGZrZB0m4wo3INfp6wVax+6JInhECCchpbdifI2jOYwLfIEbvK:kEQH2bINfBVs+6Jaej0sISOY8dvK

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1520	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 1520	792	rundll32.exe	28
PID 792 wrote to memory of 1520	792	rundll32.exe	28
PID 792 wrote to memory of 1520	792	rundll32.exe	28
PID 792 wrote to memory of 1520	792	rundll32.exe	28
PID 792 wrote to memory of 1520	792	rundll32.exe	28
PID 792 wrote to memory of 1520	792	rundll32.exe	28
PID 792 wrote to memory of 1520	792	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16b3a9a856b88840c26c897f8f2c0742a9947b237f39d40c8abcebb57cca4bcb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16b3a9a856b88840c26c897f8f2c0742a9947b237f39d40c8abcebb57cca4bcb.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1520

memory/1520-54-0x0000000000000000-mapping.dmp

Download
memory/1520-55-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download