8e6b4e62dd359c386a02f24de3f0d9e400c91fc11fdcfa0688a71094a5bd5ac3

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29/08/2023, 20:45

Target

8e6b4e62dd359c386a02f24de3f0d9e400c91fc11fdcfa0688a71094a5bd5ac3.dll
Size

895KB
MD5

5444eb7850788029e3bb909925d0514b
SHA1

cab5c09e21c66cd874709386d190e5463455983c
SHA256

8e6b4e62dd359c386a02f24de3f0d9e400c91fc11fdcfa0688a71094a5bd5ac3
SHA512

0ff00fb477b239b694f522d137ab8a393ea8c0c3d497e0c54cf7260c11ca75d7ed6a366414e7bced5e4c9fa7f7a02343abb2821ee4d7ee1777bacdc3cb66c7fa
SSDEEP

12288:OHRnGmTMwBLU5VQnP7bWKOWBCXMnnJfthO1qBvsRsY8ymzFnjKPFv5esL:oGpqLmOHFOGRthOUq9cBWt5ec

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2024	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2024	2440	rundll32.exe	28
PID 2440 wrote to memory of 2024	2440	rundll32.exe	28
PID 2440 wrote to memory of 2024	2440	rundll32.exe	28
PID 2440 wrote to memory of 2024	2440	rundll32.exe	28
PID 2440 wrote to memory of 2024	2440	rundll32.exe	28
PID 2440 wrote to memory of 2024	2440	rundll32.exe	28
PID 2440 wrote to memory of 2024	2440	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e6b4e62dd359c386a02f24de3f0d9e400c91fc11fdcfa0688a71094a5bd5ac3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e6b4e62dd359c386a02f24de3f0d9e400c91fc11fdcfa0688a71094a5bd5ac3.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2024

memory/2024-0-0x0000000010000000-0x0000000010330000-memory.dmp

Filesize
3.2MB

Download
memory/2024-1-0x0000000010000000-0x0000000010330000-memory.dmp

Filesize
3.2MB

Download
memory/2024-2-0x00000000000F0000-0x00000000000F3000-memory.dmp

Filesize
12KB

Download