992041836264b5f63e46db2bde569c600344ebd3b537569aad8cfaa7d45974ba

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 08:28

Target

79c0dc181c80769a34fb1f7e599c53e6.dll
Size

921KB
MD5

79c0dc181c80769a34fb1f7e599c53e6
SHA1

976ec97b42c768ed47a8482ceaf9cfd3c0801427
SHA256

992041836264b5f63e46db2bde569c600344ebd3b537569aad8cfaa7d45974ba
SHA512

73aff2f40df7b232eebae673fa78044ba9ff5a05f870e964bfc099f35a723f95186f1f0ec172d071702ba4dc45f50720944994087245722d0746b8c943b654df
SSDEEP

24576:/3GeQOX6eCBoXXoiZqF3mHwv8EUAVl+Sx+dAysJhwMntm:/3GeQCAqXoZWHHAz+Sx+WysjwC8

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2856	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2856	2092	rundll32.exe	28
PID 2092 wrote to memory of 2856	2092	rundll32.exe	28
PID 2092 wrote to memory of 2856	2092	rundll32.exe	28
PID 2092 wrote to memory of 2856	2092	rundll32.exe	28
PID 2092 wrote to memory of 2856	2092	rundll32.exe	28
PID 2092 wrote to memory of 2856	2092	rundll32.exe	28
PID 2092 wrote to memory of 2856	2092	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79c0dc181c80769a34fb1f7e599c53e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\79c0dc181c80769a34fb1f7e599c53e6.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2856