050a3db985fe0180e985301a918783faea7dd720cb7259c597f1ef5a0dad325a

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-08-2023 14:29

Target

winthrusterpropj/HookDLL/H_Hayat_x32.dll
Size

15KB
MD5

fb6220758edfa39039e72a39ca14f66e
SHA1

d129c107e6eef34dc9ee45ead2a9266a9d9f5c0a
SHA256

567559749b615f54722897814baa4ab7e5c51caef0704805cc04aa1bc89f99eb
SHA512

d759b5692cfc5efdfdc167ee1747726a7082c71b43dccab650f8096fff9b2fcb2ac824f0c9353c0acfdcdbb83deef32696a0ae5fdd04a2ceb4047c659f315524
SSDEEP

384:gVeKO4bBl0324W1MeHwy3prDcquLaKUAqgT5TprWG:oeKO442X5DcquLaKU3gW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2976 wrote to memory of 2892	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 2892	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 2892	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 2892	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 2892	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 2892	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 2892	2976	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\winthrusterpropj\HookDLL\H_Hayat_x32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\winthrusterpropj\HookDLL\H_Hayat_x32.dll,#1
  2⤵
  PID:2892

memory/2892-54-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2892-55-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2892-57-0x00000000001D0000-0x00000000001D2000-memory.dmp

Filesize
8KB

Download
memory/2892-56-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2892-58-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2892-59-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download