c5977998b59d68ee158750de123e3079c17a4955dd313f50b51384ec6d656371

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 18:05

Target

c5977998b59d68ee158750de123e3079c17a4955dd313f50b51384ec6d656371.dll
Size

3.6MB
MD5

5d13be58c8b84d20fc6b174adb0d7fd2
SHA1

296bd5773cca82e1ae296091ec59749b6639ef86
SHA256

c5977998b59d68ee158750de123e3079c17a4955dd313f50b51384ec6d656371
SHA512

57367591dc5b53cb32c0fddd196020e275cad26873644954343be2696cec877a20b7ea64560ea6c6c6293d18a7fbc7558fa59934db37e3d5d01d6152d69eb2c8
SSDEEP

49152:WXkKSKW4We1jKEGgPKfzU5R5+CAO9wnFoQqkyKHqGZtzp860YOXeD9TNe1:lXKW4WeZLBKo5R5+6kPqkoG7a60tX

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2984	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2984	1688	rundll32.exe	28
PID 1688 wrote to memory of 2984	1688	rundll32.exe	28
PID 1688 wrote to memory of 2984	1688	rundll32.exe	28
PID 1688 wrote to memory of 2984	1688	rundll32.exe	28
PID 1688 wrote to memory of 2984	1688	rundll32.exe	28
PID 1688 wrote to memory of 2984	1688	rundll32.exe	28
PID 1688 wrote to memory of 2984	1688	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5977998b59d68ee158750de123e3079c17a4955dd313f50b51384ec6d656371.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5977998b59d68ee158750de123e3079c17a4955dd313f50b51384ec6d656371.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2984