d6a8aa39d67e9e78bf2b99e9809c1b417c27e02af42f4bd24cf796b810cd0f67

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 05:22

Target

2006469339989/green/hook.dll
Size

375KB
MD5

fd99de6554e0d23d611a21d0aa6688db
SHA1

13f3acbbe5ba538bb982216189aec79c234ebcc2
SHA256

119d8b448698cbab512a18c9dbc09ca8355261732caf26de67f4efab460b617d
SHA512

cbaf58917ff09a839e9b00193ac7b43fa9af56608d5e7a642d021bf75c0e73d901c6eef7da242f1f7a5b5f584af65b646813a68852609075f409216c867a14e1
SSDEEP

6144:xoN84eftfFNhdDFhbIZs/mdn/FMdRwqyDMfvb0Na+XDejTucrkHLn22BLD:xoQl3DH0Zs/wtYRsMb0Na+Xbr2+

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1724	rundll32.exe
1724	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1724	2072	rundll32.exe	28
PID 2072 wrote to memory of 1724	2072	rundll32.exe	28
PID 2072 wrote to memory of 1724	2072	rundll32.exe	28
PID 2072 wrote to memory of 1724	2072	rundll32.exe	28
PID 2072 wrote to memory of 1724	2072	rundll32.exe	28
PID 2072 wrote to memory of 1724	2072	rundll32.exe	28
PID 2072 wrote to memory of 1724	2072	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2006469339989\green\hook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2006469339989\green\hook.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1724