f2bcad1b411d43e61993d40f1423f07c8e3a0cbd81ff4f2cdc5998c01853ffe5

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 23:38

Target

f2bcad1b411d43e61993d40f1423f07c8e3a0cbd81ff4f2cdc5998c01853ffe5.dll
Size

836KB
MD5

85a07d673eebe3f1ddb17e071b1124bc
SHA1

33883010b3f153333b7681f4f7bff0f486d204a2
SHA256

f2bcad1b411d43e61993d40f1423f07c8e3a0cbd81ff4f2cdc5998c01853ffe5
SHA512

e3fae8c5fc460f1162b13cce5551ef1864b7eed4e5d838dfbf9e3786d747cbae1413b852a6ff6a876973684f8e4500cc5fa4144cdfd98e6fbc2a06874cabbece
SSDEEP

12288:0LiIZ7OUOcYhc5Uoch2U/2N3s0PHMpMueWNmiY1BSoZbmftkdXZeOW7kZ:02UOcYhb/qs+CxVmLeok7kZ

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2076	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2076	1700	rundll32.exe	28
PID 1700 wrote to memory of 2076	1700	rundll32.exe	28
PID 1700 wrote to memory of 2076	1700	rundll32.exe	28
PID 1700 wrote to memory of 2076	1700	rundll32.exe	28
PID 1700 wrote to memory of 2076	1700	rundll32.exe	28
PID 1700 wrote to memory of 2076	1700	rundll32.exe	28
PID 1700 wrote to memory of 2076	1700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2bcad1b411d43e61993d40f1423f07c8e3a0cbd81ff4f2cdc5998c01853ffe5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2bcad1b411d43e61993d40f1423f07c8e3a0cbd81ff4f2cdc5998c01853ffe5.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2076

memory/2076-0-0x0000000010000000-0x00000000100F3000-memory.dmp

Filesize
972KB

Download