0bf6c99e1d2139831885901a5f549d723e9aa0e9dd86d7a4a75fea211aa3b085

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/08/2023, 20:30

Target

0bf6c99e1d2139831885901a5f549d723e9aa0e9dd86d7a4a75fea211aa3b085.dll
Size

1.9MB
MD5

2c9a6f98231390fdc1356986f35e59d6
SHA1

64fa0845450c51fb9243eca100c1b2ba534784e7
SHA256

0bf6c99e1d2139831885901a5f549d723e9aa0e9dd86d7a4a75fea211aa3b085
SHA512

4e100a2318831a5c04c1dad44bd4046d802752f9fcb316ed7e16d4d2e8e8a421467849ee02b31c0c788327fbeac67f1968fd7bb0c44175af638dc57f248a3c6c
SSDEEP

49152:ezLz3ORGmPd6TY+s8KuqGaX0ToIBAUZLY0a:EX+RGedKJBAUZL

Score

1^/10

Suspicious use of SetWindowsHookEx 6 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2520	2160	rundll32.exe	28
PID 2160 wrote to memory of 2520	2160	rundll32.exe	28
PID 2160 wrote to memory of 2520	2160	rundll32.exe	28
PID 2160 wrote to memory of 2520	2160	rundll32.exe	28
PID 2160 wrote to memory of 2520	2160	rundll32.exe	28
PID 2160 wrote to memory of 2520	2160	rundll32.exe	28
PID 2160 wrote to memory of 2520	2160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bf6c99e1d2139831885901a5f549d723e9aa0e9dd86d7a4a75fea211aa3b085.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bf6c99e1d2139831885901a5f549d723e9aa0e9dd86d7a4a75fea211aa3b085.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2520