56e62518fdf791d5c5f673dcc004b0569c5dd4108e2873adf16cae76fec91e5d

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:37

Target

$PLUGINSDIR/Hookkernel.dll
Size

275KB
MD5

65c2129a5c0cabd657022cf49a1a96a3
SHA1

03c529e0226eb5b41cd91708512dbd58edecd600
SHA256

0aa0271fc27552af57fd171c3288b00b600c912a60d8752bf70f90b997f5d67c
SHA512

b9900c3f6c93cf30c55cf718d96743728535bcb820ffaf4efa3c1ab874c684903a8fb30c2e88babdd468c2badc49306186df95f32d86bfb1a84d8d182bc8143c
SSDEEP

3072:VOGElO2Vtd2LW5ukXA8l7xLsx1BuAYzPWMYCWyRQzaniwlXs5Yo4qD1icgE:FEzrd2LWDXA8lVsNczPWtCW/zO3XtooE

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

2492 rundll32.exe
2492 rundll32.exe
2492 rundll32.exe
2492 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

2492 rundll32.exe

pid	process
2492	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2200 wrote to memory of 2492	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2492	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2492	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2492	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2492	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2492	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2492	2200	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Hookkernel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200

memory/2492-0-0x00000000005A0000-0x00000000005E5000-memory.dmp

Filesize
276KB

Download