f015075c0c46ac0659fd97b82f09e8bdcd60fd018d6b860a938b594ac62be44c

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 00:41

Target

2212e308d515aa342f184473f9700441.dll
Size

28KB
MD5

2212e308d515aa342f184473f9700441
SHA1

bfe47453f3bba8c50907499cf00f92b08682e40c
SHA256

f015075c0c46ac0659fd97b82f09e8bdcd60fd018d6b860a938b594ac62be44c
SHA512

e5a3ae14df9478e3b710a598a9e6efb204847a5063e949fb2459eac246e69592dcb7427ca5c7dba241e9b0ad6dfbfb18c3b78d8c3b45c1dd45dee43fe204a938
SSDEEP

192:ZsQznfvw5dRBkK8ysZuat3/Izh1bVHXlR8qd97rTewwTc0oh9TWN5:Zsaf45d/twh3/Izhr3V7r4jQEr

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2224	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2224	1868	rundll32.exe	28
PID 1868 wrote to memory of 2224	1868	rundll32.exe	28
PID 1868 wrote to memory of 2224	1868	rundll32.exe	28
PID 1868 wrote to memory of 2224	1868	rundll32.exe	28
PID 1868 wrote to memory of 2224	1868	rundll32.exe	28
PID 1868 wrote to memory of 2224	1868	rundll32.exe	28
PID 1868 wrote to memory of 2224	1868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2212e308d515aa342f184473f9700441.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2212e308d515aa342f184473f9700441.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2224