9bb98ef2776de78a4e95dacdc0a853d2891a8bc2ed7fef1545c7537c250fb0c9

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 21:05

Target

9bb98ef2776de78a4e95dacdc0a853d2891a8bc2ed7fef1545c7537c250fb0c9.dll
Size

552KB
MD5

9b18467c8831b2b8ab005dff8e0e2b07
SHA1

8879f40aba71a66eef26beadb7571ec2514d412b
SHA256

9bb98ef2776de78a4e95dacdc0a853d2891a8bc2ed7fef1545c7537c250fb0c9
SHA512

d4e3123b5c36fa664de0bd6ef2af2d0546f33b89e3e33a3ee525b2502098ce12960e3fd309431da0ceb45cb4877be42c6ae2ec67019efda9d95d4081af25d751
SSDEEP

12288:G0I/UBofjf+LpkMueogw73RO9pNuNiaHt1oj7pYs/TTdYH6fkU4Fgxd:SpyLyMuDgw7+N4iaeX/TiH6fkU4m

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1772 rundll32.exe

pid	process
1772	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1264 wrote to memory of 1772	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1772	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1772	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1772	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1772	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1772	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1772	1264	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bb98ef2776de78a4e95dacdc0a853d2891a8bc2ed7fef1545c7537c250fb0c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bb98ef2776de78a4e95dacdc0a853d2891a8bc2ed7fef1545c7537c250fb0c9.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:1772

memory/1772-54-0x0000000000000000-mapping.dmp

Download
memory/1772-55-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/1772-56-0x0000000010000000-0x000000001014E000-memory.dmp

Filesize
1.3MB

Download
memory/1772-57-0x0000000010000000-0x000000001014E000-memory.dmp

Filesize
1.3MB

Download
memory/1772-58-0x0000000010000000-0x000000001014E000-memory.dmp

Filesize
1.3MB

Download
memory/1772-59-0x0000000010000000-0x000000001014E000-memory.dmp

Filesize
1.3MB

Download