44822ed98fd21211f8716fea25c452b021980945e84a30fa1dc02850d6b9c627

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:54

Target

易CE/safemode.dll
Size

2.0MB
MD5

44872cd22bef04e8f364862ebf3719f7
SHA1

c79c02d662c06d884cbc5e7f2d99f620be98008e
SHA256

6834692e8eb27ee91b98ed7375f67cbb355913f3d19f74bb294b981d5565c7c4
SHA512

3b8e0d32f53dcf83168139c06cfa2c6d9aca64b9bfca1e4809e647174354282559705c5207c0c60711ab204ba6e0cdfed0d9b6db998e0c3226e877970e48e1ae
SSDEEP

24576:NdCv2XMtGtlNMcaKFz+gA8clVOBghpYWUpPb5juUFayb0gaGau73BxKf5Ub3Mt64:NdaM03OBeIaJ43HK+b3Mt66c8DJ

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\fhbku.dll rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1128 rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\fhbku.dll	rundll32.exe

pid	process
1128	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2884 wrote to memory of 1128	2884	rundll32.exe	rundll32.exe
PID 2884 wrote to memory of 1128	2884	rundll32.exe	rundll32.exe
PID 2884 wrote to memory of 1128	2884	rundll32.exe	rundll32.exe
PID 2884 wrote to memory of 1128	2884	rundll32.exe	rundll32.exe
PID 2884 wrote to memory of 1128	2884	rundll32.exe	rundll32.exe
PID 2884 wrote to memory of 1128	2884	rundll32.exe	rundll32.exe
PID 2884 wrote to memory of 1128	2884	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\易CE\safemode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\易CE\safemode.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:1128