8a5c8a4b4d05ccd8a4826598f219081319e153be0a5a13a9e27b8baba286f74c

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 17:22

Target

8a5c8a4b4d05ccd8a4826598f219081319e153be0a5a13a9e27b8baba286f74c.dll
Size

756KB
MD5

5d74dd9740e59e0e740c164da209723b
SHA1

a43b281b74d06b0c86f3e6819aadca2a6076b60b
SHA256

8a5c8a4b4d05ccd8a4826598f219081319e153be0a5a13a9e27b8baba286f74c
SHA512

50a5ba66b68bc0ea0e2c0df185c9e9351b1af5475c867454cf31de1cfa6a21ecfc18094a4ca4bccec824ebb940536f88adf8dc298ea0328e9f9d8d7965396948
SSDEEP

6144:6rcRusjLlf0cnh4sAHcf1ty6yZfKN22NkuiWMn1MpoqnseHcSDF7WKBcAkMyLVST:6rcRuSLlMK1U2qj2SJeHcKXcLJC

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1736	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a5c8a4b4d05ccd8a4826598f219081319e153be0a5a13a9e27b8baba286f74c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a5c8a4b4d05ccd8a4826598f219081319e153be0a5a13a9e27b8baba286f74c.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1736