1dca91cb7cc387cc708dd058bd12a300fafac08ede939c2f696e576e19273cc5

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01/09/2023, 06:22

Target

1dca91cb7cc387cc708dd058bd12a300fafac08ede939c2f696e576e19273cc5.dll
Size

5.2MB
MD5

d1f02b842a2436bb5d8e94751d098d4f
SHA1

4edc5d6b32cde8fc6a36a2ff3e392347219837ee
SHA256

1dca91cb7cc387cc708dd058bd12a300fafac08ede939c2f696e576e19273cc5
SHA512

b8105e6aec35f0b39c86a636c6e8d589f66249fe1f95afaa8f0847044650770de62ace28f403be40108414ae4205275b21bc3f9f33fef92729977f1cd947b7f9
SSDEEP

49152:ou8tUDv8sODg7qwYZIzGEdbX7FpfSwPIPoCzKCcF:smDv8DsewYZIzGY7LfSwPIPoQN

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2088	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2088	1796	rundll32.exe	28
PID 1796 wrote to memory of 2088	1796	rundll32.exe	28
PID 1796 wrote to memory of 2088	1796	rundll32.exe	28
PID 1796 wrote to memory of 2088	1796	rundll32.exe	28
PID 1796 wrote to memory of 2088	1796	rundll32.exe	28
PID 1796 wrote to memory of 2088	1796	rundll32.exe	28
PID 1796 wrote to memory of 2088	1796	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dca91cb7cc387cc708dd058bd12a300fafac08ede939c2f696e576e19273cc5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dca91cb7cc387cc708dd058bd12a300fafac08ede939c2f696e576e19273cc5.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2088