8c6a41f9557a58b0b4de66972853c357e515695f8a0cd53f1bcdb0cc2dff5b04

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/01/2023, 21:42

Target

8c6a41f9557a58b0b4de66972853c357e515695f8a0cd53f1bcdb0cc2dff5b04.dll
Size

2.1MB
MD5

7026b8f3cf07b74f8cf1d12c7b02a93c
SHA1

0d422fce7ce3abfc59d95ef97e83767d7ce0cc4c
SHA256

8c6a41f9557a58b0b4de66972853c357e515695f8a0cd53f1bcdb0cc2dff5b04
SHA512

32bec423d445a7b202b765da97d9eecc2c8f4cd06e7452f43fb4759c0293d8dbcafc529783ab59febb88261953cc9a028cbc867d465e12a346a32a4d6ce01cdd
SSDEEP

24576:cJx20Ax1WR15UW6vcoN/EEiri/wd0wzdHOQIIXUFMkcPLOmRxzNpMHjHDMH6w:czldiW63PiTdLzdHxI5ByzNaHjHCn

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1892	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26
PID 1160 wrote to memory of 1892	1160	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c6a41f9557a58b0b4de66972853c357e515695f8a0cd53f1bcdb0cc2dff5b04.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c6a41f9557a58b0b4de66972853c357e515695f8a0cd53f1bcdb0cc2dff5b04.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1892

memory/1892-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download