817d08e6f45c3e66db44c130358eae8ff3d8f56738949748378c751c90650828

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 12:40

Target

1f2574d52f35d33f385298dc6bca9ffc.dll
Size

50KB
MD5

1f2574d52f35d33f385298dc6bca9ffc
SHA1

913e2fc9deb802c86603ba67ef0e675d60bbcab3
SHA256

817d08e6f45c3e66db44c130358eae8ff3d8f56738949748378c751c90650828
SHA512

76fbf23969fbb7a6f143e1f2ea5adbee0b268a20cf36f699458edd8ba1e101f9afbfc3610a4dfca71ce97cfbf6bc2074536f581772130dcb0cb72bd411b8a158
SSDEEP

768:mRhKTUlTuw6y0VMe42phpCMAnqhTZxhCmsELbOkW8lm4X1XtN1c0:mUUlTuwcOjqhsmsy/JvlS

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sezepinu.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\lezulupa	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
804	rundll32.exe
804	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 804	3044	rundll32.exe	16
PID 3044 wrote to memory of 804	3044	rundll32.exe	16
PID 3044 wrote to memory of 804	3044	rundll32.exe	16
PID 3044 wrote to memory of 804	3044	rundll32.exe	16
PID 3044 wrote to memory of 804	3044	rundll32.exe	16
PID 3044 wrote to memory of 804	3044	rundll32.exe	16
PID 3044 wrote to memory of 804	3044	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f2574d52f35d33f385298dc6bca9ffc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044

memory/804-1-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/804-2-0x0000000000180000-0x0000000000185000-memory.dmp

Filesize
20KB

Download
memory/804-0-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/804-3-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download