d3a05c8ea550c02fd54bfef2cc474079b323c224dcc39aed7bbe5e350da95d57

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
22-06-2023 20:08

Target

d3a05c8ea550c02fd54bfef2cc474079b323c224dcc39aed7bbe5e350da95d57.dll
Size

374KB
MD5

93b9df578e39aae757e86410bb73f75b
SHA1

dd89787fc16cada85fec5cf8358285e12540229d
SHA256

d3a05c8ea550c02fd54bfef2cc474079b323c224dcc39aed7bbe5e350da95d57
SHA512

578c3721a2b2aa4a43bb7fd9ebdf77f4ef92df4951a55e806d350266d5afc8c612a64d78bfa275b80ff48c8884ac22040712fd3379a0f145c2b4501f1099d147
SSDEEP

6144:jJa46VMtgMUfzG0Vo0iKIZt2gaQlD4dLaFjXiFNUj2s9AT13z7:QKmM2e0iyQl4dLwjXHdux

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

2032 rundll32.exe

pid	process
2032	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1188 wrote to memory of 2032	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 2032	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 2032	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 2032	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 2032	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 2032	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 2032	1188	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3a05c8ea550c02fd54bfef2cc474079b323c224dcc39aed7bbe5e350da95d57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3a05c8ea550c02fd54bfef2cc474079b323c224dcc39aed7bbe5e350da95d57.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:2032

memory/2032-54-0x0000000010000000-0x00000000100EC000-memory.dmp

Filesize
944KB

Download
memory/2032-55-0x0000000010000000-0x00000000100EC000-memory.dmp

Filesize
944KB

Download
memory/2032-56-0x0000000010000000-0x00000000100EC000-memory.dmp

Filesize
944KB

Download
memory/2032-57-0x0000000010000000-0x00000000100EC000-memory.dmp

Filesize
944KB

Download
memory/2032-58-0x0000000010000000-0x00000000100EC000-memory.dmp

Filesize
944KB

Download