5ea85ac874b09f5b8d48f1490926fa2997ea570a6c62ecdd901f883dd24dc792

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 22:31

Target

inproc.dll
Size

53KB
MD5

5f05ee1e30365c2dda5f0170bf685c6e
SHA1

d27e7ba2c255f6ee369855bfaba237bd305e6343
SHA256

e4b3ad12a170ed3a3d0f3848282d8a4241621a39eea41c34a47c12d5f0a79d42
SHA512

4d17fedfd917e714540f4e2368fedcac8117ad588c79ade08a5d5973ae3a81fff1d16b55f5246e7dc9344406b8cd4ada0e4a373a30fb744b6fff87d1aca3d7ac
SSDEEP

384:fSrArFxqzNWRemYMoprRJ1C5cR8QqyWMLveFcurQg3GCBHdFE96KJCOLLvYivcoT:OkzK4G9J1C2pjLvk3WEH3EIKJrLHvsi

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3008	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3008	2996	rundll32.exe	28
PID 2996 wrote to memory of 3008	2996	rundll32.exe	28
PID 2996 wrote to memory of 3008	2996	rundll32.exe	28
PID 2996 wrote to memory of 3008	2996	rundll32.exe	28
PID 2996 wrote to memory of 3008	2996	rundll32.exe	28
PID 2996 wrote to memory of 3008	2996	rundll32.exe	28
PID 2996 wrote to memory of 3008	2996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\inproc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\inproc.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3008