12a97140043e32e3a4f15bb9a17e16692d06c33cd56bb6d497ac6be2c5c02093

Analysis

max time kernel
22s
max time network
113s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 21:27

Target

dll/DLL_MouseEventHook.dll
Size

33KB
MD5

ce1fa57e863ccdc8cfe9ae58e51198df
SHA1

4270ab5f9dc5cef1bca3238a67ad65cd79b5d67f
SHA256

b998518fe80b73d140d12e09a8bcc25e4c9e40e6623c6b86006693169b590a63
SHA512

705a87363f9efa38284923dcc699840afaa40a5355d7093358808a56bfada9d5a2882e7cd89dce74b1170cc9e6e88e7145e39fef5bfba9016e7f8d549a5decc4
SSDEEP

384:Jh2Vf22kXzFdga8Dhrq4ICms1+pKns8E+hw9lTd3+lnu6EDHplX1/NC3vynAXmk:65S0lqbCh1I38dh4x3GnTEDK3vynAB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1016 wrote to memory of 336	1016	rundll32.exe	rundll32.exe
PID 1016 wrote to memory of 336	1016	rundll32.exe	rundll32.exe
PID 1016 wrote to memory of 336	1016	rundll32.exe	rundll32.exe
PID 1016 wrote to memory of 336	1016	rundll32.exe	rundll32.exe
PID 1016 wrote to memory of 336	1016	rundll32.exe	rundll32.exe
PID 1016 wrote to memory of 336	1016	rundll32.exe	rundll32.exe
PID 1016 wrote to memory of 336	1016	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\DLL_MouseEventHook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1016

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\DLL_MouseEventHook.dll,#1
2⤵
PID:336

memory/336-54-0x0000000000000000-mapping.dmp

Download
memory/336-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download