5ea85ac874b09f5b8d48f1490926fa2997ea570a6c62ecdd901f883dd24dc792

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 22:31

Target
inproc.dll
Size 53KB
Sample240213-2ffg2aae9z
SHA256 e4b3ad12a170ed3a3d0f3848282d8a4241621a39eea41c34a47c12d5f0a79d42
MD5 5f05ee1e30365c2dda5f0170bf685c6e
SHA1 d27e7ba2c255f6ee369855bfaba237bd305e6343
SHA512 4d17fedfd917e714540f4e2368fedcac8117ad588c79ade08a5d5973ae3a81fff1d16b55f5246e7dc9344406b8cd4ada0e4a373a30fb744b6fff87d1aca3d7ac
SSDEEP 384:fSrArFxqzNWRemYMoprRJ1C5cR8QqyWMLveFcurQg3GCBHdFE96KJCOLLvYivcoT:OkzK4G9J1C2pjLvk3WEH3EIKJrLHvsi
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3008	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3008	2996	rundll32.exe	28
PID 2996 wrote to memory of 3008	2996	rundll32.exe	28
PID 2996 wrote to memory of 3008	2996	rundll32.exe	28
PID 2996 wrote to memory of 3008	2996	rundll32.exe	28
PID 2996 wrote to memory of 3008	2996	rundll32.exe	28
PID 2996 wrote to memory of 3008	2996	rundll32.exe	28
PID 2996 wrote to memory of 3008	2996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\inproc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\inproc.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3008