c3ef2e53f53cb14ba9ad15b40ce4e3700867d0b0fd45727c829d54afde91e5e8

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26/03/2023, 01:13

Target

23f04ba936568e9a7c9dce7a6beb52c9be7eb13b734cd390c99e7546cbe1973d.dll
Size

14.5MB
MD5

3bd5aea364326cdfa667651a93e7a4c9
SHA1

f33b4a83e038363c1a4df919e6f6e0e41dba9334
SHA256

23f04ba936568e9a7c9dce7a6beb52c9be7eb13b734cd390c99e7546cbe1973d
SHA512

7bd4e742b4d683b79de54eaf7d8b215252212921b8a53d1fbfc8e51ce43505c003da62fd126663bc04bbc65b8f77b85232c78ea6ecba8a4e425c28c0e9c80dc3
SSDEEP

393216:00Rly5ZnSHLe1tvwDTtwJuefdrX780dNYbg4A358TjGNrS1aKbBICZBSJLGWIGC2:NRlyP71tvwDTtwJuefdrX780dNYbg4Az

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1768	rundll32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1768	1300	rundll32.exe	28
PID 1300 wrote to memory of 1768	1300	rundll32.exe	28
PID 1300 wrote to memory of 1768	1300	rundll32.exe	28
PID 1300 wrote to memory of 1768	1300	rundll32.exe	28
PID 1300 wrote to memory of 1768	1300	rundll32.exe	28
PID 1300 wrote to memory of 1768	1300	rundll32.exe	28
PID 1300 wrote to memory of 1768	1300	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23f04ba936568e9a7c9dce7a6beb52c9be7eb13b734cd390c99e7546cbe1973d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23f04ba936568e9a7c9dce7a6beb52c9be7eb13b734cd390c99e7546cbe1973d.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1768