e4bbd4323f29a5781909dd8b7e030607eb49c77659fd94b37ac0ab8a7ee4de07

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:33

Target

034f0ffe5ac9d233798d471d99383f66.dll
Size

100KB
MD5

034f0ffe5ac9d233798d471d99383f66
SHA1

db23949fc139b2ecc735a558e146709898884935
SHA256

e4bbd4323f29a5781909dd8b7e030607eb49c77659fd94b37ac0ab8a7ee4de07
SHA512

f312e0978784ed48ce43a7a967d3fb18e2467631d395c46f2d6dd314d3ba6cb81f7f8929a3eb0934789466a0caa4bb3e0a1b0a01f405568fa1a5ef9747faca61
SSDEEP

1536:Dnys5590LogsjTKSH7E+tDSpx9hqBqF3KlBniV14ba:Dnym59Qogsa+tDSpfh1F3KlBni6a

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2752	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2752	2696	rundll32.exe	27
PID 2696 wrote to memory of 2752	2696	rundll32.exe	27
PID 2696 wrote to memory of 2752	2696	rundll32.exe	27
PID 2696 wrote to memory of 2752	2696	rundll32.exe	27
PID 2696 wrote to memory of 2752	2696	rundll32.exe	27
PID 2696 wrote to memory of 2752	2696	rundll32.exe	27
PID 2696 wrote to memory of 2752	2696	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\034f0ffe5ac9d233798d471d99383f66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\034f0ffe5ac9d233798d471d99383f66.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2752