912c0413d0f3270fada637ae976cd59cdd4b5ada0957d9b5fb1c7bf30e8922a7

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 11:17

Target

895fbb330d74856fdf2f0fe1c4a8c976.dll
Size

859KB
MD5

895fbb330d74856fdf2f0fe1c4a8c976
SHA1

39c06d77e1e7943e4df0dcc7148aa3a97f06170a
SHA256

912c0413d0f3270fada637ae976cd59cdd4b5ada0957d9b5fb1c7bf30e8922a7
SHA512

6c68127953b20a05f943970984de8fcc0197719b00b1d82d85f493bc97015f2e30799a5ce58076aa7876b27204d71fe3f3fe54b7235525c6449a46aa0b22d453
SSDEEP

24576:H2+K5PwE9v4w0zO20ActTpcCmILYKV+u9O4qZFIYN:Hw5PlJ0TJcttcCmIf+u9YZrN

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1984	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1984	828	rundll32.exe	28
PID 828 wrote to memory of 1984	828	rundll32.exe	28
PID 828 wrote to memory of 1984	828	rundll32.exe	28
PID 828 wrote to memory of 1984	828	rundll32.exe	28
PID 828 wrote to memory of 1984	828	rundll32.exe	28
PID 828 wrote to memory of 1984	828	rundll32.exe	28
PID 828 wrote to memory of 1984	828	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\895fbb330d74856fdf2f0fe1c4a8c976.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\895fbb330d74856fdf2f0fe1c4a8c976.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1984