c2e53dd8ea050fb15921cafdfe7df4479797bf190b5d9f206d51669125cbbc52

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:49

Target

13cab4755952ae1a4e44923d1701ed93.dll
Size

27KB
MD5

13cab4755952ae1a4e44923d1701ed93
SHA1

c49c5f4814618bdeb3c1c736219530d6da76732c
SHA256

c2e53dd8ea050fb15921cafdfe7df4479797bf190b5d9f206d51669125cbbc52
SHA512

6c74d2e3653b01a87249013db873d1f295f50e63f2fc2e0d17f198c8d8c6118b04d7940832f7c3a6c0754d88782f8d21d5c319e7c0c1584606af4973aa2bb447
SSDEEP

384:hYeZBjMXIKJ1B7nz+4fd9Sp8WKOa0KjBX5wcNNcjc9ZfApo0E:meYIcnnz+SSJha0KjJqYcjc9ZfAk

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1280	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 1280	2884	rundll32.exe	28
PID 2884 wrote to memory of 1280	2884	rundll32.exe	28
PID 2884 wrote to memory of 1280	2884	rundll32.exe	28
PID 2884 wrote to memory of 1280	2884	rundll32.exe	28
PID 2884 wrote to memory of 1280	2884	rundll32.exe	28
PID 2884 wrote to memory of 1280	2884	rundll32.exe	28
PID 2884 wrote to memory of 1280	2884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13cab4755952ae1a4e44923d1701ed93.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13cab4755952ae1a4e44923d1701ed93.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1280

memory/1280-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1280-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download