dc573df5c8e40a6469e6cbdfa1178d3a7afe09b7af0a781479c19a42435728d0

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 18:46

Target

00de4539386cfe3da3d51e29378e5ed9.dll
Size

100KB
MD5

00de4539386cfe3da3d51e29378e5ed9
SHA1

1a783110ec0276f2ddee733f2ce41cf2aa80c7cb
SHA256

dc573df5c8e40a6469e6cbdfa1178d3a7afe09b7af0a781479c19a42435728d0
SHA512

ac900d78e62348538721e31ea53f35dbe6ed4595b5bf7ece0921186ff0985f87123260cc819d57397fc6d3e87cfbd3d155afe267ce50bcc48bc681bf4967543f
SSDEEP

1536:Dnys5590LogsjTKSH7E+tDSpx9hqBqF3KlBniV14b6:Dnym59Qogsa+tDSpfh1F3KlBni66

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1112	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1112	2056	rundll32.exe	28
PID 2056 wrote to memory of 1112	2056	rundll32.exe	28
PID 2056 wrote to memory of 1112	2056	rundll32.exe	28
PID 2056 wrote to memory of 1112	2056	rundll32.exe	28
PID 2056 wrote to memory of 1112	2056	rundll32.exe	28
PID 2056 wrote to memory of 1112	2056	rundll32.exe	28
PID 2056 wrote to memory of 1112	2056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00de4539386cfe3da3d51e29378e5ed9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00de4539386cfe3da3d51e29378e5ed9.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1112