6071a0d884ed5341613b87631d574b063a27bff7f294b8d42d668bfe3c5a833f

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
27/06/2023, 20:16

Target

6071a0d884ed5341613b87631d574b063a27bff7f294b8d42d668bfe3c5a833f.dll
Size

3.0MB
MD5

c4ea4820765a11f05672f424ac38b3b4
SHA1

a62769f095433f128e1504af5d84e4f0f96c2eb0
SHA256

6071a0d884ed5341613b87631d574b063a27bff7f294b8d42d668bfe3c5a833f
SHA512

0fa5498dfb251e04a2909519c710150bd66747e326db4738cc1a0bbaee74419ad28f12deef5dc3b812f7e37113a5412244e3603ead4cc4643c69a6b203ce8179
SSDEEP

49152:2vYjpCOCQdLzdHxI5ByzNaHjHrG3Namlh624rQX9xe:3VCOCgXdS4zuYTd8uP

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2008	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2008	1992	rundll32.exe	28
PID 1992 wrote to memory of 2008	1992	rundll32.exe	28
PID 1992 wrote to memory of 2008	1992	rundll32.exe	28
PID 1992 wrote to memory of 2008	1992	rundll32.exe	28
PID 1992 wrote to memory of 2008	1992	rundll32.exe	28
PID 1992 wrote to memory of 2008	1992	rundll32.exe	28
PID 1992 wrote to memory of 2008	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6071a0d884ed5341613b87631d574b063a27bff7f294b8d42d668bfe3c5a833f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6071a0d884ed5341613b87631d574b063a27bff7f294b8d42d668bfe3c5a833f.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2008

memory/2008-54-0x0000000010000000-0x000000001034B000-memory.dmp

Filesize
3.3MB

Download