7bfe719eceff5059ea415cc8c2a9c5c48d92b0e4d36b48e04606443e1fb37c69

Analysis

max time kernel
152s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 10:52

Target

7bfe719eceff5059ea415cc8c2a9c5c48d92b0e4d36b48e04606443e1fb37c69.dll
Size

972KB
MD5

0bf56542b15f3e0ce2e9e085c159be21
SHA1

9ad482f6ff7fa4dd302c4ed9f1c6801c6d4f1c67
SHA256

7bfe719eceff5059ea415cc8c2a9c5c48d92b0e4d36b48e04606443e1fb37c69
SHA512

d1ff17cd5ac9a83e17a3c1fdaaf65f17a656305cbfd3cb8edc78076330b19efc6e1bbbf74149e4e2c42074ae6f9ef92e49fcfa1cfe3ab1e8ebfa1008af9a7ded
SSDEEP

12288:9C0FjKygQdHpfbk23AuCbKOf5K3xKs0qmhl8bY/YPt:9CsFgWHpzkCAuaf0hKspI8bEYt

Score

8^/10

Blocklisted process makes network request 6 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2008	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2008	1888	rundll32.exe	89
PID 1888 wrote to memory of 2008	1888	rundll32.exe	89
PID 1888 wrote to memory of 2008	1888	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7bfe719eceff5059ea415cc8c2a9c5c48d92b0e4d36b48e04606443e1fb37c69.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7bfe719eceff5059ea415cc8c2a9c5c48d92b0e4d36b48e04606443e1fb37c69.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetWindowsHookEx
  PID:2008