4999e69daec550867e541fc0389ec20696b64e97ba644684131facad6cbb5cce

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/08/2023, 20:53

Target

4999e69daec550867e541fc0389ec20696b64e97ba644684131facad6cbb5cce.dll
Size

912KB
MD5

cf306c89048a1200823699e1d529708b
SHA1

d35bc748df5a2bf7d5d64e0d7bfd22c762ad1977
SHA256

4999e69daec550867e541fc0389ec20696b64e97ba644684131facad6cbb5cce
SHA512

39b3064e0cbac1478df6e4d7710e1dd1b8ccc264ba0db76d0b9b4f7ef9534728173f8e6243a850e2c4796bf18e96feac212df6292f98a293ec57e6d488158f85
SSDEEP

12288:xvsSNJGaA8RG4zUpwy7InjOzaa98LisHjHdrVIhJIJK:xvt5wpN7Inj490iy5rVmJIJK

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
524	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 524	2604	rundll32.exe	28
PID 2604 wrote to memory of 524	2604	rundll32.exe	28
PID 2604 wrote to memory of 524	2604	rundll32.exe	28
PID 2604 wrote to memory of 524	2604	rundll32.exe	28
PID 2604 wrote to memory of 524	2604	rundll32.exe	28
PID 2604 wrote to memory of 524	2604	rundll32.exe	28
PID 2604 wrote to memory of 524	2604	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4999e69daec550867e541fc0389ec20696b64e97ba644684131facad6cbb5cce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4999e69daec550867e541fc0389ec20696b64e97ba644684131facad6cbb5cce.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:524