5b631a4b85b4d28f2e1b412c0b636e592b970f70982ef0853e3903b1e70316ab

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:47

Target

5b631a4b85b4d28f2e1b412c0b636e592b970f70982ef0853e3903b1e70316ab.dll
Size

628KB
MD5

4e69293084d66904773a1c1bdbabbf30
SHA1

c0051c6cbcc4402233dbbeeebc861619b05eea53
SHA256

5b631a4b85b4d28f2e1b412c0b636e592b970f70982ef0853e3903b1e70316ab
SHA512

b39a00de17fa5b7a26289b2d1c3d638c5fe6ac187b9ee36b2571a675576ccd2b9137e37ab09f57781ae92054fffc80a473602e5b018954ffd41e884daba83f8a
SSDEEP

6144:ESRJSkjBs7/+0W+ifcKr+E2KkS7Wgs4xmcIW5ZY7TaDsUHWbXkwKKwanVK/5:EoScMBW+ifcKaAx5xXY7s2bTnc/5

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

880 rundll32.exe

pid	process
880	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1032 wrote to memory of 880	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 880	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 880	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 880	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 880	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 880	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 880	1032	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b631a4b85b4d28f2e1b412c0b636e592b970f70982ef0853e3903b1e70316ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b631a4b85b4d28f2e1b412c0b636e592b970f70982ef0853e3903b1e70316ab.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:880

memory/880-0-0x000000007DC50000-0x000000007DD50000-memory.dmp

Filesize
1024KB

Download
memory/880-3-0x0000000073800000-0x000000007444A000-memory.dmp

Filesize
12.3MB

Download