009a11917cde33938e09d27a2910c7ea21e311dfa761acdfcfade1a6c61db37e

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 11:09

Target

009a11917cde33938e09d27a2910c7ea21e311dfa761acdfcfade1a6c61db37e.dll
Size

848KB
MD5

d6ebbfc18848579215f63aac6976d6f5
SHA1

e2baa6c33ddf9ceaffe17a45b5f8163c5273f4fd
SHA256

009a11917cde33938e09d27a2910c7ea21e311dfa761acdfcfade1a6c61db37e
SHA512

42d523310ac8a7d2f283571aa3e8242bd52ca2adf421be181648c4a3e8e60b08dd71c3bd44d2ab0c13b6f1e95d5129c32ee7052c782dc9baa9d76a9c7f506ea5
SSDEEP

24576:yYmXqtSYzdiwLTOggX6xX47vnAqg4Wrd:6XsSYzdxP32yX4rnAddh

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2132	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2132	1672	rundll32.exe	28
PID 1672 wrote to memory of 2132	1672	rundll32.exe	28
PID 1672 wrote to memory of 2132	1672	rundll32.exe	28
PID 1672 wrote to memory of 2132	1672	rundll32.exe	28
PID 1672 wrote to memory of 2132	1672	rundll32.exe	28
PID 1672 wrote to memory of 2132	1672	rundll32.exe	28
PID 1672 wrote to memory of 2132	1672	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\009a11917cde33938e09d27a2910c7ea21e311dfa761acdfcfade1a6c61db37e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\009a11917cde33938e09d27a2910c7ea21e311dfa761acdfcfade1a6c61db37e.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2132

memory/2132-0-0x0000000010000000-0x00000000102F9000-memory.dmp

Filesize
3.0MB

Download
memory/2132-1-0x0000000010000000-0x00000000102F9000-memory.dmp

Filesize
3.0MB

Download
memory/2132-2-0x0000000010000000-0x00000000102F9000-memory.dmp

Filesize
3.0MB

Download
memory/2132-3-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download
memory/2132-4-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download