a4556c5417ccafc24becd8a1716d242b0a8964d5562ff36a505ea9c3b068ffd3

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25-08-2023 23:17

Target

a4556c5417ccafc24becd8a1716d242b0a8964d5562ff36a505ea9c3b068ffd3.dll
Size

2.6MB
MD5

ad9701822763db16e60d338eb17659c3
SHA1

5f1d6f42e1fc7732d69815778cc8c8c0a0efd688
SHA256

a4556c5417ccafc24becd8a1716d242b0a8964d5562ff36a505ea9c3b068ffd3
SHA512

a7117c595f6904f13e3df5e767194a55541721cabb3f66ee609da73d218a466dc1ffacb4e264f0a9ec65e16ec23e09a228581b2b3d8e6a82fae9db8c2a52917c
SSDEEP

49152:bXWqHjdAlG40TVApPHWy6Tp+s8KuqGaX0ToIBAUZLY73nb:z7HjdAlG440lJJBAUZLE

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2516	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2516	2456	rundll32.exe	28
PID 2456 wrote to memory of 2516	2456	rundll32.exe	28
PID 2456 wrote to memory of 2516	2456	rundll32.exe	28
PID 2456 wrote to memory of 2516	2456	rundll32.exe	28
PID 2456 wrote to memory of 2516	2456	rundll32.exe	28
PID 2456 wrote to memory of 2516	2456	rundll32.exe	28
PID 2456 wrote to memory of 2516	2456	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4556c5417ccafc24becd8a1716d242b0a8964d5562ff36a505ea9c3b068ffd3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4556c5417ccafc24becd8a1716d242b0a8964d5562ff36a505ea9c3b068ffd3.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c wmic diskdrive get serialnumber
    3⤵
    PID:2840

memory/2516-0-0x0000000000C20000-0x0000000000C79000-memory.dmp

Filesize
356KB

Download
memory/2516-1-0x0000000000C20000-0x0000000000C79000-memory.dmp

Filesize
356KB

Download