1b3f39e0d2c736b7dbbc037931820f690698b2d4caa903abd49a8104375f0def

Analysis

max time kernel
82s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-04-2023 07:40

Target

1/HwidProtector.dll
Size

228KB
MD5

e4c67cc149ca5fa61382f8654409feee
SHA1

408931b18d31562fe9f3419d7663a1cafcc7f65f
SHA256

f2f264bd4faa5fccf3bd32a9a7b6b5ffc90754c759dca3127be0ff107bef33a6
SHA512

49de4dc0de0f25dd279a33124fc4fdc2b80cec6105c70290db48f77068775f1727c5f4d996bf41f5ded424de0318a5eef9e0ad08050a0fd3a8964c94afa89f8b
SSDEEP

1536:6kig1Ac42h743XNd55vQryAdbEPVBbM44DdROpiMnesVWDwVPhVbOucFCDrMq1np:jT1lh743rvQ4R46hJ/Uyxu9yLBRiy

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1188 rundll32.exe

pid	process
1188	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1\HwidProtector.dll,#1
1⤵
- Suspicious use of SetWindowsHookEx
PID:1188

memory/1188-54-0x00000000001C0000-0x0000000000206000-memory.dmp

Filesize
280KB

Download