0d1aad1dd6c22b12c1c1a62f13d1056efafa42d841eb72664ea396b005975286

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
10/01/2023, 18:44

Target

0d1aad1dd6c22b12c1c1a62f13d1056efafa42d841eb72664ea396b005975286.dll
Size

1.1MB
MD5

d213690862dc268cb6e0f05894feded5
SHA1

099c057686d5ede0a74b9e23f75cbabac30b9030
SHA256

0d1aad1dd6c22b12c1c1a62f13d1056efafa42d841eb72664ea396b005975286
SHA512

ff3f18af4135e33d3188b71b909072608fda54b5a30eadcf3c686dbeb744ac157839d9d7acaa1f45b971601c4f793b6ce7c7eb00994d113789a93c96842fdf66
SSDEEP

24576:cPnMf4AH5mIpVb7k3BcPVaivNGkKcznKbK63LD:cfIpV6BctbNGkbznz0D

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1616	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1616	1212	rundll32.exe	28
PID 1212 wrote to memory of 1616	1212	rundll32.exe	28
PID 1212 wrote to memory of 1616	1212	rundll32.exe	28
PID 1212 wrote to memory of 1616	1212	rundll32.exe	28
PID 1212 wrote to memory of 1616	1212	rundll32.exe	28
PID 1212 wrote to memory of 1616	1212	rundll32.exe	28
PID 1212 wrote to memory of 1616	1212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d1aad1dd6c22b12c1c1a62f13d1056efafa42d841eb72664ea396b005975286.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d1aad1dd6c22b12c1c1a62f13d1056efafa42d841eb72664ea396b005975286.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1616

memory/1616-55-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download