7282511813c4f941717ac9f7e22dea59354d7a5659721664623bbfa9407bb549

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:47

Target

6101f3b66dc1b58f8f18faedca0a1117.dll
Size

69KB
MD5

6101f3b66dc1b58f8f18faedca0a1117
SHA1

f64f7c19031dbd6f04c6fb9f7a0fd41f2d8a560d
SHA256

7282511813c4f941717ac9f7e22dea59354d7a5659721664623bbfa9407bb549
SHA512

aee18fd4c9cf11518d77a37126859c92cb280f15f58700ac27e712bccaddbc925203b3f667b09eb7aad187137610df0c426430a119cf6f6017b71d83ad2df305
SSDEEP

1536:KKm1vNA98nvjYRCKJF+JaXPpNqWh2T1aIZpMTnAAzqRbitDllHwztuQ:KKAxnFK6wXxNqWUT1HMTnSQtRlHwz7

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mabagasu.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\damereda	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3032	rundll32.exe
3032	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3032	2964	rundll32.exe	28
PID 2964 wrote to memory of 3032	2964	rundll32.exe	28
PID 2964 wrote to memory of 3032	2964	rundll32.exe	28
PID 2964 wrote to memory of 3032	2964	rundll32.exe	28
PID 2964 wrote to memory of 3032	2964	rundll32.exe	28
PID 2964 wrote to memory of 3032	2964	rundll32.exe	28
PID 2964 wrote to memory of 3032	2964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6101f3b66dc1b58f8f18faedca0a1117.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6101f3b66dc1b58f8f18faedca0a1117.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:3032

memory/3032-1-0x00000000003B0000-0x0000000000441000-memory.dmp

Filesize
580KB

Download
memory/3032-0-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3032-2-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3032-3-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download