ead791414bf8b9f1126e4d6b099ecf939f595d03d5d30c69dc05c637806ea0d4

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 23:09

Target

bin/CameraDll.dll
Size

259KB
MD5

f6164e18be446ed9dbddcef2776923c8
SHA1

0de1a8af9848c8796fa09ae4e9488524800d2b3f
SHA256

ddd1c13886bdd148d1a1bcbe94e572d3bf54665a5f0711b7c5e823e6418a5caf
SHA512

f841e6b49ef108e5ccfd4dc47c4df53d82971449229648411554b275256b4a5fb2c998db3dfe30b757d9bf81ee4a6b76f8d773beae57347cb46eb495f78b3b9c
SSDEEP

6144:BjPK6XyF5LdYV7MEPkQu1DWhTBqi627nMDtd4:BjhX49dcsQsWhTsicd4

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1380	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1380	2568	rundll32.exe	30
PID 2568 wrote to memory of 1380	2568	rundll32.exe	30
PID 2568 wrote to memory of 1380	2568	rundll32.exe	30
PID 2568 wrote to memory of 1380	2568	rundll32.exe	30
PID 2568 wrote to memory of 1380	2568	rundll32.exe	30
PID 2568 wrote to memory of 1380	2568	rundll32.exe	30
PID 2568 wrote to memory of 1380	2568	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\CameraDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\CameraDll.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1380

memory/1380-0-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-1-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-2-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-3-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-4-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-5-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-6-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-7-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-8-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-9-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-10-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-11-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-12-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-13-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-14-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download
memory/1380-15-0x0000000010000000-0x0000000010087000-memory.dmp

Filesize
540KB

Download