82a3627c24ca324b52f685ec1de4d11e9cd4e8db3d33db17bb7d1530c980ed02

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 12:53

Target

4b7d188e9dc6b751fce0661614ec6f23.dll
Size

367KB
MD5

4b7d188e9dc6b751fce0661614ec6f23
SHA1

443ebf64a058623a61bf54d6ed573eee212f7a33
SHA256

82a3627c24ca324b52f685ec1de4d11e9cd4e8db3d33db17bb7d1530c980ed02
SHA512

9fdc1e3493b2ff2542918ae39a0d2c8f916712eccd381fa0074b69d5d2a333a98d269d1eda11f0fb8a8627c79375e495552ed54c48fe5229d19fed84d43d4ac9
SSDEEP

6144:/GWUdHZuTbXKkINsIKdRB68B48n4AsoauvkiSgXq/J+P6F9dg9J:NyHZuXX61EB5bJknV/kiFn0J

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2536	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2536	2444	rundll32.exe	16
PID 2444 wrote to memory of 2536	2444	rundll32.exe	16
PID 2444 wrote to memory of 2536	2444	rundll32.exe	16
PID 2444 wrote to memory of 2536	2444	rundll32.exe	16
PID 2444 wrote to memory of 2536	2444	rundll32.exe	16
PID 2444 wrote to memory of 2536	2444	rundll32.exe	16
PID 2444 wrote to memory of 2536	2444	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b7d188e9dc6b751fce0661614ec6f23.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b7d188e9dc6b751fce0661614ec6f23.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2536

memory/2536-0-0x0000000000170000-0x00000000001D1000-memory.dmp

Filesize
388KB

Download