b373839d1f83fa8db6dda5352a0750d57e0763d43b7dac5be6b82d34b53f562e

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/06/2023, 19:34

Target

b373839d1f83fa8db6dda5352a0750d57e0763d43b7dac5be6b82d34b53f562e.dll
Size

956KB
MD5

07ac7056103e24abbffdbef296b10ed4
SHA1

4a9b607881e0cce21d510e6dfd3314ffaa37a230
SHA256

b373839d1f83fa8db6dda5352a0750d57e0763d43b7dac5be6b82d34b53f562e
SHA512

fa106b2bf5202188e4fde90aa69a96442cf9db93698c8ff1545d2fe8a20357e2222d1568d6631d591df11c71a63e030da78a2c459c59afb553bc606fbe40bb27
SSDEEP

12288:znM6kUSFwzxjtE4H237IUi3A+p6SNBk/hhZo7V3:znM6rSFwVvHY7riwy6YBCK7V3

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1072	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1072	1712	rundll32.exe	27
PID 1712 wrote to memory of 1072	1712	rundll32.exe	27
PID 1712 wrote to memory of 1072	1712	rundll32.exe	27
PID 1712 wrote to memory of 1072	1712	rundll32.exe	27
PID 1712 wrote to memory of 1072	1712	rundll32.exe	27
PID 1712 wrote to memory of 1072	1712	rundll32.exe	27
PID 1712 wrote to memory of 1072	1712	rundll32.exe	27
PID 1072 wrote to memory of 1104	1072	rundll32.exe	28
PID 1072 wrote to memory of 1104	1072	rundll32.exe	28
PID 1072 wrote to memory of 1104	1072	rundll32.exe	28
PID 1072 wrote to memory of 1104	1072	rundll32.exe	28
PID 1072 wrote to memory of 1708	1072	rundll32.exe	30
PID 1072 wrote to memory of 1708	1072	rundll32.exe	30
PID 1072 wrote to memory of 1708	1072	rundll32.exe	30
PID 1072 wrote to memory of 1708	1072	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b373839d1f83fa8db6dda5352a0750d57e0763d43b7dac5be6b82d34b53f562e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b373839d1f83fa8db6dda5352a0750d57e0763d43b7dac5be6b82d34b53f562e.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c dnconsole.exe killapp --index 393504 --packagename MZ
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c dnconsole.exe adb --index 393504 --command "push /data/data/MZ/databases"
    3⤵
    PID:1708