e74b336b3e4f6c4704f4dafc170c4bb1f603f95577586af29c482c1b76f67e9d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 05:11

Target

297682e86b07a21f21ba2fd7a2bcf605.dll
Size

50KB
MD5

297682e86b07a21f21ba2fd7a2bcf605
SHA1

bb7da8843bcb45c14d37643c8fa68ac5d0a35a5b
SHA256

e74b336b3e4f6c4704f4dafc170c4bb1f603f95577586af29c482c1b76f67e9d
SHA512

9dfb644aaefbcc08f6ac71e1dc63e7042fbcab548b666197ca4f05694fc022e5a400b1579879c6a1c80dc00634e34f02f588992e35e49434b985a6143787a72c
SSDEEP

768:DrGuiPkGXclalsXsGne3xWU7Laql0plnlc2EN3NbfcVaxWHjCzCi9:D1qmalsXcC1bc2E9NTc+NV

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\nezumeda	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\wobilobe.dll	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2188	rundll32.exe
2188	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2188	2376	rundll32.exe	16
PID 2376 wrote to memory of 2188	2376	rundll32.exe	16
PID 2376 wrote to memory of 2188	2376	rundll32.exe	16
PID 2376 wrote to memory of 2188	2376	rundll32.exe	16
PID 2376 wrote to memory of 2188	2376	rundll32.exe	16
PID 2376 wrote to memory of 2188	2376	rundll32.exe	16
PID 2376 wrote to memory of 2188	2376	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\297682e86b07a21f21ba2fd7a2bcf605.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\297682e86b07a21f21ba2fd7a2bcf605.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:2188

memory/2188-1-0x00000000001C0000-0x00000000001C5000-memory.dmp

Filesize
20KB

Download
memory/2188-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2188-2-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download