01f40e2c93eebaee0b91efef8bb8afb952f2099e4c78a4aed06e33535cc49e8b

Analysis

max time kernel
28s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09/07/2023, 19:39

Target

01f40e2c93eebaee0b91efef8bb8afb952f2099e4c78a4aed06e33535cc49e8b.dll
Size

1.6MB
MD5

60cf7cfafdc07f0f3f0cd48cbe176562
SHA1

2988a2d69fddec8fb6929913224fd049c4c9fd2c
SHA256

01f40e2c93eebaee0b91efef8bb8afb952f2099e4c78a4aed06e33535cc49e8b
SHA512

936b6c39a4f0331cd0f971f3c2f4414ea80f1a7396a9405d30e790e5dad88b5b397ad240fa367a55bcc24499de743f1bc8d44c5751968cd8a48600d175c0cce7
SSDEEP

12288:l4cfB5SjcZ6Lfo9BpbKxxVpVIyERfwRYGba0rG3UuzxNw:l4uBULfcXbIxVPIpRfwRVa0rG31xNw

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2368	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2368	1496	rundll32.exe	28
PID 1496 wrote to memory of 2368	1496	rundll32.exe	28
PID 1496 wrote to memory of 2368	1496	rundll32.exe	28
PID 1496 wrote to memory of 2368	1496	rundll32.exe	28
PID 1496 wrote to memory of 2368	1496	rundll32.exe	28
PID 1496 wrote to memory of 2368	1496	rundll32.exe	28
PID 1496 wrote to memory of 2368	1496	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01f40e2c93eebaee0b91efef8bb8afb952f2099e4c78a4aed06e33535cc49e8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01f40e2c93eebaee0b91efef8bb8afb952f2099e4c78a4aed06e33535cc49e8b.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2368