a2bc5372658351f1f8442a9820c2f29a3cbaa1e19df6adc8ad6861932266ffb7

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 03:06

Target

foredu.com demo software/xSpeed/hook.dll
Size

6KB
MD5

6b46cac49251fcb795e2fecf3aae0760
SHA1

2cc33cdac78baa361a115d21a931ce584769256e
SHA256

872135a2d322ddcefc41638864dba44a7a3b5456f089a1275dcb6fba04797fa2
SHA512

33debbd0a7f48089b4c2baaa9da112241d857a88d434c150777374c39f28a07e90b2226decc5455287556dc0442d5fe624de96c36fa0b62b78c647d20f2c60da
SSDEEP

96:QNkc5W3T8GTI75R7x4ZCz9X9/6QhfDYuYAq766xyf3X3X3frPf3aF:Q6cQT8GTIlRF4Zg9X5lEuYx79cnT

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2140	rundll32.exe
2140	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2140	2400	rundll32.exe	28
PID 2400 wrote to memory of 2140	2400	rundll32.exe	28
PID 2400 wrote to memory of 2140	2400	rundll32.exe	28
PID 2400 wrote to memory of 2140	2400	rundll32.exe	28
PID 2400 wrote to memory of 2140	2400	rundll32.exe	28
PID 2400 wrote to memory of 2140	2400	rundll32.exe	28
PID 2400 wrote to memory of 2140	2400	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\foredu.com demo software\xSpeed\hook.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\foredu.com demo software\xSpeed\hook.dll",#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2140