7230ba89c332b852c504bc4e3d7348c0a36daf8ffb14f973e580fbb48a16d002

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 06:02

Target

caa9d3f65568ea85a21afdbf6ccfce4a.dll
Size

16KB
MD5

caa9d3f65568ea85a21afdbf6ccfce4a
SHA1

30a04daf5ec8f0be62ee71504ef96ce8089a6a25
SHA256

7230ba89c332b852c504bc4e3d7348c0a36daf8ffb14f973e580fbb48a16d002
SHA512

c4d445fd3444e20ca20c7bb97b4de2a98700eafb7f7007fd23f3517c3a348fc92f3a26ac2447a8b5f0533211f6bc604fe3c42aa9be11e1c67a1c83e26dd119fb
SSDEEP

384:z/3ckfSkHkqckMz7J8JpH3gN9UNms83v+aB8ac2NAlF:z/NSEJqi7w8Nmj3VSac2Sl

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2876	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2876	2868	rundll32.exe	28
PID 2868 wrote to memory of 2876	2868	rundll32.exe	28
PID 2868 wrote to memory of 2876	2868	rundll32.exe	28
PID 2868 wrote to memory of 2876	2868	rundll32.exe	28
PID 2868 wrote to memory of 2876	2868	rundll32.exe	28
PID 2868 wrote to memory of 2876	2868	rundll32.exe	28
PID 2868 wrote to memory of 2876	2868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\caa9d3f65568ea85a21afdbf6ccfce4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\caa9d3f65568ea85a21afdbf6ccfce4a.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2876

memory/2876-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2876-1-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download