2fb06b8ced3186e63ebd56168572e14c9253895cfee31b9c98a4288e9509b7bf

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 08:47

Target

2fb06b8ced3186e63ebd56168572e14c9253895cfee31b9c98a4288e9509b7bf.dll
Size

1.1MB
MD5

2e130e970a19d99422ca749ede571db7
SHA1

7317f332c0c1db322ff2e86b2726d6942c48973e
SHA256

2fb06b8ced3186e63ebd56168572e14c9253895cfee31b9c98a4288e9509b7bf
SHA512

7c16ce45e51c8c715395fdb9326604567f9520edc1f932ae9b9c8370c15dc920a41925133ea641070b4b0b62cb25fc261f7fec2541003ccc4c9084c0c02e0ec5
SSDEEP

24576:Ry9byZ7GAiBvXdAblNB3PUN4ByNayPl13r6ipIEEOWo/xL:R8bW7GAlhfUN4gF1kEEOr5

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2068	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2068	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2068	2124	rundll32.exe	28
PID 2124 wrote to memory of 2068	2124	rundll32.exe	28
PID 2124 wrote to memory of 2068	2124	rundll32.exe	28
PID 2124 wrote to memory of 2068	2124	rundll32.exe	28
PID 2124 wrote to memory of 2068	2124	rundll32.exe	28
PID 2124 wrote to memory of 2068	2124	rundll32.exe	28
PID 2124 wrote to memory of 2068	2124	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fb06b8ced3186e63ebd56168572e14c9253895cfee31b9c98a4288e9509b7bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fb06b8ced3186e63ebd56168572e14c9253895cfee31b9c98a4288e9509b7bf.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetWindowsHookEx
  PID:2068

memory/2068-0-0x0000000010000000-0x0000000010450000-memory.dmp

Filesize
4.3MB

Download
memory/2068-1-0x0000000010000000-0x0000000010450000-memory.dmp

Filesize
4.3MB

Download
memory/2068-2-0x0000000010000000-0x0000000010450000-memory.dmp

Filesize
4.3MB

Download
memory/2068-3-0x00000000001E0000-0x00000000001E3000-memory.dmp

Filesize
12KB

Download