8a7675b6d5a7c3bc130f5562799744a60cf30523e6d98835a37c9e41a54b0206

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 20:39

Target

8a7675b6d5a7c3bc130f5562799744a60cf30523e6d98835a37c9e41a54b0206.dll
Size

912KB
MD5

eb35db8424caca2cafa945a807a5291e
SHA1

eb95495adc506b9f74bdc61695a40a6104642053
SHA256

8a7675b6d5a7c3bc130f5562799744a60cf30523e6d98835a37c9e41a54b0206
SHA512

e2334366f2f9ada7d9a1fda48f39c73f7918bae4d89819e041361853fbbb88bff2280aab477369332790d6f38b1fddaa8bc6b6954b0e6d425c8c4784834820db
SSDEEP

12288:xvsSNJGaA8RG4zUpwy7InjOzaa98LisHjHdrVIhJIJi:xvt5wpN7Inj490iy5rVmJIJi

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2444	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2444	2616	rundll32.exe	28
PID 2616 wrote to memory of 2444	2616	rundll32.exe	28
PID 2616 wrote to memory of 2444	2616	rundll32.exe	28
PID 2616 wrote to memory of 2444	2616	rundll32.exe	28
PID 2616 wrote to memory of 2444	2616	rundll32.exe	28
PID 2616 wrote to memory of 2444	2616	rundll32.exe	28
PID 2616 wrote to memory of 2444	2616	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a7675b6d5a7c3bc130f5562799744a60cf30523e6d98835a37c9e41a54b0206.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a7675b6d5a7c3bc130f5562799744a60cf30523e6d98835a37c9e41a54b0206.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2444