51c6a043459efd7e9e8ae17bc97bf5491198c66930df97fc6b266e3c43cef9c2

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:32

Target

1011af58922c1062b62f26c5e676e90c.dll
Size

68KB
MD5

1011af58922c1062b62f26c5e676e90c
SHA1

436868238570d0967448437c01ba1972b3483ba0
SHA256

51c6a043459efd7e9e8ae17bc97bf5491198c66930df97fc6b266e3c43cef9c2
SHA512

1d1230381e00caf777025d4521569e24f6ec03d49abaa476f3d700f86de602ebe695ed46a35cbc88da8d4506e8570dddd5ec307591f3c375880ba352bd2403f9
SSDEEP

1536:DbGDRXyC72yv1TK4KuexIm7VL8UkywPnkJA4vfv1cRctePf:DSD1j7TYHWC8gwPnoA4vfv1cgen

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\zehosoka.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\fuzasale	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3012	rundll32.exe
3012	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 3012	2228	rundll32.exe	28
PID 2228 wrote to memory of 3012	2228	rundll32.exe	28
PID 2228 wrote to memory of 3012	2228	rundll32.exe	28
PID 2228 wrote to memory of 3012	2228	rundll32.exe	28
PID 2228 wrote to memory of 3012	2228	rundll32.exe	28
PID 2228 wrote to memory of 3012	2228	rundll32.exe	28
PID 2228 wrote to memory of 3012	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1011af58922c1062b62f26c5e676e90c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1011af58922c1062b62f26c5e676e90c.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:3012

memory/3012-1-0x0000000000240000-0x00000000002D0000-memory.dmp

Filesize
576KB

Download
memory/3012-0-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3012-2-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3012-3-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download