0dcf5851b4a17a7de91b308f8e3001549686763c2efe94776f5a555df1053202

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 07:54

Target

88f8c279f3727cbf29dff75447d289c8.dll
Size

545KB
MD5

88f8c279f3727cbf29dff75447d289c8
SHA1

e78669bc2f7014501cc18761caeb9a57b6e92e57
SHA256

0dcf5851b4a17a7de91b308f8e3001549686763c2efe94776f5a555df1053202
SHA512

8a3e67f572824d74be87e206bb332b9a6224e061832550cbd01729d40872e4ac162fc3f34ed6f26df30c2760e1ebccc30e3aef6570305c3f432a8ebc55e3c886
SSDEEP

12288:wPiXlYB9ooxW5E+yYNTPOVT6nglx3E4rI0DDZFYbZmM29:waeToj9ygOVTj3EcD4ZzC

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3068	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3068	3048	rundll32.exe	28
PID 3048 wrote to memory of 3068	3048	rundll32.exe	28
PID 3048 wrote to memory of 3068	3048	rundll32.exe	28
PID 3048 wrote to memory of 3068	3048	rundll32.exe	28
PID 3048 wrote to memory of 3068	3048	rundll32.exe	28
PID 3048 wrote to memory of 3068	3048	rundll32.exe	28
PID 3048 wrote to memory of 3068	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88f8c279f3727cbf29dff75447d289c8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\88f8c279f3727cbf29dff75447d289c8.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3068