e1e21cb9836f45d608582e7340d5bf94c281a3c45080eb743aef2ed8568a1907

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
27-08-2023 20:44

Target

e1e21cb9836f45d608582e7340d5bf94c281a3c45080eb743aef2ed8568a1907.dll
Size

912KB
MD5

a906aa2ea5bd49d5b717c09f2e4bc893
SHA1

0ae257f6c4b5550e27dca866cafff957caafa68f
SHA256

e1e21cb9836f45d608582e7340d5bf94c281a3c45080eb743aef2ed8568a1907
SHA512

b68874e66f484c3f909c4765a53c82b8af2c10385bd107e163fa1b45d63ee1b45be455eacb914e35f90d016198964063671ffde722bbe41c726a812e1314084d
SSDEEP

12288:xvsSNJGaA8RG4zUpwy7InjOzaa98LisHjHdrVIhJIJ7:xvt5wpN7Inj490iy5rVmJIJ7

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1716	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1716	2964	rundll32.exe	28
PID 2964 wrote to memory of 1716	2964	rundll32.exe	28
PID 2964 wrote to memory of 1716	2964	rundll32.exe	28
PID 2964 wrote to memory of 1716	2964	rundll32.exe	28
PID 2964 wrote to memory of 1716	2964	rundll32.exe	28
PID 2964 wrote to memory of 1716	2964	rundll32.exe	28
PID 2964 wrote to memory of 1716	2964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1e21cb9836f45d608582e7340d5bf94c281a3c45080eb743aef2ed8568a1907.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1e21cb9836f45d608582e7340d5bf94c281a3c45080eb743aef2ed8568a1907.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1716