c0f8a98f8eba381379ce8c78df5a5b2f7068956af90009f53db8482230bd68a7

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
05-11-2023 13:50

Target

c0f8a98f8eba381379ce8c78df5a5b2f7068956af90009f53db8482230bd68a7.dll
Size

1.3MB
MD5

3a08845d073e86bf903bc6d183ecee3f
SHA1

3e4f649fbdb3869e4335f885b834b97931cb9fe9
SHA256

c0f8a98f8eba381379ce8c78df5a5b2f7068956af90009f53db8482230bd68a7
SHA512

f60c5a05d92cfc09243d9ac8c9ac69fc8cccc7aa9c4f63b0c372902be7036c9143806a1e5f194aa0ed2d18be5c317b9f8eb0e0d1f190dde8c62422fd52a3b528
SSDEEP

12288:oobNcZXn1xDOrUgy8z6DT5dp7Q25oiY5K5b9WuxZLcqmlB:ooxcZX1lOFys6f5dO25oiMIMORmlB

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2508	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2508	1736	rundll32.exe	28
PID 1736 wrote to memory of 2508	1736	rundll32.exe	28
PID 1736 wrote to memory of 2508	1736	rundll32.exe	28
PID 1736 wrote to memory of 2508	1736	rundll32.exe	28
PID 1736 wrote to memory of 2508	1736	rundll32.exe	28
PID 1736 wrote to memory of 2508	1736	rundll32.exe	28
PID 1736 wrote to memory of 2508	1736	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0f8a98f8eba381379ce8c78df5a5b2f7068956af90009f53db8482230bd68a7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0f8a98f8eba381379ce8c78df5a5b2f7068956af90009f53db8482230bd68a7.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2508