1a8dbff8d74c193d7baa8a79951ca1f13761e51c1e0188fbcb615c4b0428a45e

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20/09/2023, 00:08

Target

1a8dbff8d74c193d7baa8a79951ca1f13761e51c1e0188fbcb615c4b0428a45e.dll
Size

374KB
MD5

c38d8d6fb845939fc5705c06863ca4f2
SHA1

80e2cdb1cc75c15b41f615bd3b794b4ed4f1f2bb
SHA256

1a8dbff8d74c193d7baa8a79951ca1f13761e51c1e0188fbcb615c4b0428a45e
SHA512

4fe3dd4cfb215156e1096a8e8103f5d1f317f7b51586942b35b2d61c322d302b9d5b378395b14c797b5bf6cb444aec60b99382e699a5e72363a0f0c4b160fa65
SSDEEP

6144:2phgJ0OM9cQUSULju4uFv02WRp5vMI5kU71tfxrPVg1aUDZ2x:1J06hr8mPC4UNa

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2120	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2120	1956	rundll32.exe	28
PID 1956 wrote to memory of 2120	1956	rundll32.exe	28
PID 1956 wrote to memory of 2120	1956	rundll32.exe	28
PID 1956 wrote to memory of 2120	1956	rundll32.exe	28
PID 1956 wrote to memory of 2120	1956	rundll32.exe	28
PID 1956 wrote to memory of 2120	1956	rundll32.exe	28
PID 1956 wrote to memory of 2120	1956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a8dbff8d74c193d7baa8a79951ca1f13761e51c1e0188fbcb615c4b0428a45e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a8dbff8d74c193d7baa8a79951ca1f13761e51c1e0188fbcb615c4b0428a45e.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2120