2dc4c306da01adebbc2304f3d82d009bc3ca4a097209e4f6dd5400ef4f93cbc8

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 04:54

Target

HShield/AspINet.dll
Size

728KB
MD5

1e7e7f5afd378d1b108b7649abb584be
SHA1

886c83a45002c77951c0d85046cb7edf5d9ab951
SHA256

21f8027c6be26c3957640c4c8862cb7a23b0b904af8c42f2b70961f414a5d17e
SHA512

1cff6c8db7f8c4e372c36a4d0fdaf61f504e5f20c25bc392cb3d9c51bb3eeec348675f640ebcafe81a284fa72c24dd8eab1d6c183d31473d386f00134c701835
SSDEEP

6144:Kn80RvQuXFzcTDGEhBU5BGO38+t/eQQK7kgMIZU2sgigJz3cT+eWKPbjSFDKlPE/:LaQuXlEDGGovHYglMqJO+kPbjA2e/

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1628 rundll32.exe

pid	process
1628	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2280 wrote to memory of 1628	2280	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 1628	2280	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 1628	2280	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 1628	2280	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 1628	2280	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 1628	2280	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 1628	2280	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HShield\AspINet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HShield\AspINet.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1628