b234bbfe5236ecc72c46c0c03aa3796e7a306ef1d1bf8329826b6ea89102b60a

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 17:05

Target

b234bbfe5236ecc72c46c0c03aa3796e7a306ef1d1bf8329826b6ea89102b60a.dll
Size

912KB
MD5

0c06ad0125edf9d7e0b4f0441cd86757
SHA1

55c29a85002cb55e599b8722162da06c934ddea2
SHA256

b234bbfe5236ecc72c46c0c03aa3796e7a306ef1d1bf8329826b6ea89102b60a
SHA512

b313f84f2061bb545c5c4bfb5f6029eb39df7cad98f7d30799460be03e44dd65125ba4654e712e2773eae75ceb548550ecb742b6c94c021b79ea952806f5ad46
SSDEEP

12288:xvsSNJGaA8RG4zUpwy7InjOzaa98LisHjHdrVIhJIJV:xvt5wpN7Inj490iy5rVmJIJV

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1996	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1996	2828	rundll32.exe	28
PID 2828 wrote to memory of 1996	2828	rundll32.exe	28
PID 2828 wrote to memory of 1996	2828	rundll32.exe	28
PID 2828 wrote to memory of 1996	2828	rundll32.exe	28
PID 2828 wrote to memory of 1996	2828	rundll32.exe	28
PID 2828 wrote to memory of 1996	2828	rundll32.exe	28
PID 2828 wrote to memory of 1996	2828	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b234bbfe5236ecc72c46c0c03aa3796e7a306ef1d1bf8329826b6ea89102b60a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b234bbfe5236ecc72c46c0c03aa3796e7a306ef1d1bf8329826b6ea89102b60a.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1996