2dc4c306da01adebbc2304f3d82d009bc3ca4a097209e4f6dd5400ef4f93cbc8

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 04:54

Target

HShield/AhnUpGS.dll
Size

172KB
MD5

f2a08bcf92b8ddb5676f89cd0babaa45
SHA1

d2e19ecfce47333d0ef6a597c46f6ef0fa0b1199
SHA256

0f7d5fbff4ee279b671bbb9259933b980c7737dce338410bee37b5ec13cf358e
SHA512

501959150e765a3f4074c079f8a5b9b5a044f3899b38b55dc0bfd0bce15a8c6472fe51031a5f751a989d355f9917e57fdf49a04bbee7e569712bc06603169e4c
SSDEEP

3072:jQrqJToUBylyBKhSBpxS5qxq1yx+ri0Q/EPqHaWubIAC6sT34GoxuZl4oQnPRWym:sBUBylyBKhSBpxS5qxq1yxUi0Q/Gq6WB

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1472	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HShield\AhnUpGS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HShield\AhnUpGS.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1472

memory/1472-0-0x0000000000130000-0x0000000000153000-memory.dmp

Filesize
140KB

Download
memory/1472-4-0x0000000000350000-0x0000000000416000-memory.dmp

Filesize
792KB

Download
memory/1472-2-0x0000000000230000-0x0000000000256000-memory.dmp

Filesize
152KB

Download
memory/1472-1-0x0000000000210000-0x0000000000225000-memory.dmp

Filesize
84KB

Download