050a3db985fe0180e985301a918783faea7dd720cb7259c597f1ef5a0dad325a

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-08-2023 14:29

Target

winthrusterpropj/HookDLL/winmm.dll
Size

1.8MB
MD5

f0de5fbb6bc4ccf4dc7fa75cefbde6ab
SHA1

1d31386e208a0d6ad5c3251985a5861e2c3e6ed2
SHA256

fb4e1856d5ed28ae0c98d14199409d18a0c7cddff887d0c53c77aabec95dd646
SHA512

bbe0613d0ae4d4854666b7fefe91e553d1f5562253c862307d931b9b330e693d24902a519ddcebf61ab90aa9eb388962f347203009f0c5a9cd171ebfd5a4cf48
SSDEEP

49152:70NFi1E6dgWippxQxQ6Mhxj0NFZt0z0UPbxFWk/J:70ZcncoS6vrE029P

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2508 rundll32.exe
2508 rundll32.exe

pid	process
2508	rundll32.exe
2508	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2792 wrote to memory of 2508	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2508	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2508	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2508	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2508	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2508	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2508	2792	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\winthrusterpropj\HookDLL\winmm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\winthrusterpropj\HookDLL\winmm.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2508

memory/2508-54-0x0000000000120000-0x000000000012E000-memory.dmp

Filesize
56KB

Download
memory/2508-55-0x0000000000120000-0x000000000012E000-memory.dmp

Filesize
56KB

Download
memory/2508-56-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/2508-57-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2508-60-0x0000000010000000-0x0000000010394000-memory.dmp

Filesize
3.6MB

Download
memory/2508-59-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2508-62-0x0000000010000000-0x0000000010394000-memory.dmp

Filesize
3.6MB

Download
memory/2508-64-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2508-66-0x0000000077D70000-0x0000000077D71000-memory.dmp

Filesize
4KB

Download