bddedda3b293e6e6f33a794b75989e0a695b7585d6f5cd932c5839f78f2cba7b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 11:44

Target

9b961f28a8881c49f0148f1d58e4e8ce.dll
Size

40KB
MD5

9b961f28a8881c49f0148f1d58e4e8ce
SHA1

92b25cd12ab7dde32357ea6376de26885ac01bf6
SHA256

bddedda3b293e6e6f33a794b75989e0a695b7585d6f5cd932c5839f78f2cba7b
SHA512

df8c016fffad274f3dc95da907ca836936663fecee29d64c858d1074587b8a6aa1b49ca4068548e05b7ebc6c696c155c0c28b49028c7af1d9b952919a63f064a
SSDEEP

384:LRUyMqckiQS/TNqDCqOHFm1fIYSboy5oFzMAdv7F/ozhWnDCxNGcuYuHJJDfjRpW:GyMqpiQ0jFmdbAoy5eMoGk6KnTlr9q

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2100	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2100	2076	rundll32.exe	28
PID 2076 wrote to memory of 2100	2076	rundll32.exe	28
PID 2076 wrote to memory of 2100	2076	rundll32.exe	28
PID 2076 wrote to memory of 2100	2076	rundll32.exe	28
PID 2076 wrote to memory of 2100	2076	rundll32.exe	28
PID 2076 wrote to memory of 2100	2076	rundll32.exe	28
PID 2076 wrote to memory of 2100	2076	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b961f28a8881c49f0148f1d58e4e8ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b961f28a8881c49f0148f1d58e4e8ce.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2100

memory/2100-0-0x0000000000170000-0x000000000017F000-memory.dmp

Filesize
60KB

Download