2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 19:53

Target

2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50.dll
Size

612KB
MD5

bba63b02068f72bb9338db22c470b2ed
SHA1

36c115e8bc3a817a6bd2a6105fe3f3b7f6b735ac
SHA256

2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50
SHA512

eb757ff55f8e1a8ebcf2757912381aa64626ea4fd5af3fdcb05256f120c7f68ac0ff6016044629cb8ed52886492bd387644400a2f143a4ff54e95e6a8c92d21c
SSDEEP

6144:YYHojk/imorOWn47GxtRFSFEogZvxiVDYBKcTDZ5K1BMCkUlxgByAMGByNr2nq:VIZmorznxxtRF6eFBXXK8mxgBIyq

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2caf2f3a51fee02fab48097acd2ee8376b14615ba5cdb958d8de389d6c602c50.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2900

memory/2900-10-0x0000000076E00000-0x0000000076F10000-memory.dmp

Filesize
1.1MB

Download
memory/2900-9-0x0000000076E11000-0x0000000076E12000-memory.dmp

Filesize
4KB

Download