b0817a3ca207a1c5a29c442d5e51581f303651648a72b45a2aac6763c6bd2f81

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 16:38

Target

b0817a3ca207a1c5a29c442d5e51581f303651648a72b45a2aac6763c6bd2f81.dll
Size

4.2MB
MD5

83a02eda2daf6d2f3a6420e19c7d616e
SHA1

f44b4929e2b8b0c724000add55763f75234b2713
SHA256

b0817a3ca207a1c5a29c442d5e51581f303651648a72b45a2aac6763c6bd2f81
SHA512

01e5245dddb12289838b260eb914cd5e445589f51653d32f66da533902ab171737a9a8050bf151bf03808bc4563599779f9dbf1f6b4addaafff53bb6effdf8ef
SSDEEP

49152:tl8AZiwh7wI7WxA0gDPWNJ+D9MIl6i66+jccNPWrUEBST1Wt6l:36w50gjSwD9My6i66scbOW

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1036	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1036	2380	rundll32.exe	28
PID 2380 wrote to memory of 1036	2380	rundll32.exe	28
PID 2380 wrote to memory of 1036	2380	rundll32.exe	28
PID 2380 wrote to memory of 1036	2380	rundll32.exe	28
PID 2380 wrote to memory of 1036	2380	rundll32.exe	28
PID 2380 wrote to memory of 1036	2380	rundll32.exe	28
PID 2380 wrote to memory of 1036	2380	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0817a3ca207a1c5a29c442d5e51581f303651648a72b45a2aac6763c6bd2f81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0817a3ca207a1c5a29c442d5e51581f303651648a72b45a2aac6763c6bd2f81.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1036