7708ac542c00c0c68ea9e8bc47f1db3278036f85ddd710e80e3865b0bdd1a67f

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 22:57

Target

59a1288aab68d2631d5d085f33c2bbd5.dll
Size

848KB
MD5

59a1288aab68d2631d5d085f33c2bbd5
SHA1

42ab80b16f852927d969f738127bc36207d85e04
SHA256

7708ac542c00c0c68ea9e8bc47f1db3278036f85ddd710e80e3865b0bdd1a67f
SHA512

78ab982ef790af7c905a20632b0d44121871822b2ffd1dbee0a8575101a9ed2bdf23db318ae4216fb5800e45fdd0b8214d9ff522ae71be9a25a20cd65516fe69
SSDEEP

12288:zMeIaQB7OJEtlyeGEWq64tvJ3gVGuotIbD+HtfzTqlB/vj9k+6UktMaF5RxR/hea:ViB7OJveGjq64HgVk6qtf/q/L9k+klmG

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2964	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2964	2108	rundll32.exe	28
PID 2108 wrote to memory of 2964	2108	rundll32.exe	28
PID 2108 wrote to memory of 2964	2108	rundll32.exe	28
PID 2108 wrote to memory of 2964	2108	rundll32.exe	28
PID 2108 wrote to memory of 2964	2108	rundll32.exe	28
PID 2108 wrote to memory of 2964	2108	rundll32.exe	28
PID 2108 wrote to memory of 2964	2108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59a1288aab68d2631d5d085f33c2bbd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59a1288aab68d2631d5d085f33c2bbd5.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2964