8b0e8d1ffbb94fe9e5f63a41e66e27ccdebb57abe6a8555ad3f64b10070ba462

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-01-2024 12:06

Target

5b3241dc90defc9c63d24633c4151b95.dll
Size

25KB
MD5

5b3241dc90defc9c63d24633c4151b95
SHA1

5d9f6769b32fd81d7f4b889d8eb167ff80265be9
SHA256

8b0e8d1ffbb94fe9e5f63a41e66e27ccdebb57abe6a8555ad3f64b10070ba462
SHA512

60d2c47156e5da1bd3fb5cda2b4dab7f08a837e58b754bd5482a378f17dac38de82c87e095955050ab67b8e5f387e87a3396ea72b2a37ed7eb1ef802bdca8312
SSDEEP

384:KFjpiJ5kTgQxPWaJnaAWTkji9LOrgoC4/WK0/A/nIKAJtxcWylYW9y:KWJ5kTcPkKOrPCIWK0/A/IPgD

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2520	rundll32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2520	2528	rundll32.exe	28
PID 2528 wrote to memory of 2520	2528	rundll32.exe	28
PID 2528 wrote to memory of 2520	2528	rundll32.exe	28
PID 2528 wrote to memory of 2520	2528	rundll32.exe	28
PID 2528 wrote to memory of 2520	2528	rundll32.exe	28
PID 2528 wrote to memory of 2520	2528	rundll32.exe	28
PID 2528 wrote to memory of 2520	2528	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b3241dc90defc9c63d24633c4151b95.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b3241dc90defc9c63d24633c4151b95.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2520

memory/2520-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2520-1-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2520-3-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2520-2-0x0000000077740000-0x0000000077850000-memory.dmp

Filesize
1.1MB

Download
memory/2520-4-0x0000000077740000-0x0000000077850000-memory.dmp

Filesize
1.1MB

Download