e3026e2bd11e4d1f35c49a32bdc24d1b29dd62394d68c51361f590ff7886e091

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-10-2023 16:50

Target

Tools/HotkeyP/hook64.dll
Size

6KB
MD5

f3b923b9486849c6adf4970d57ba8911
SHA1

16a3361e7a0b46aeb1631c614f4f3a912851a031
SHA256

f629ffc9254f6a5bfeade41bcde0d03a7a90911048802adbf24ff129d086ff93
SHA512

01d8511eda5c8cfc46f6bbabad86f24801d9e04b88ac38f315b1c3ac302c46d4b28d0ef7666e6fb739be7bcf9b523cb374bd01709fffd9a118a55902d3b6e38b
SSDEEP

48:a8RG9kewNzlW6VYZrhY3GS5QAF2Gyti8cGW6awcukiiQphll0U4JQ+IRhIRuqS:1GoFlW6eMGS2pinCanuNiQXf74RgYx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 652	1680	rundll32.exe	28
PID 1680 wrote to memory of 652	1680	rundll32.exe	28
PID 1680 wrote to memory of 652	1680	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tools\HotkeyP\hook64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1680 -s 92
  2⤵
  PID:652