bb11b7cba17b5c0dd3f248a191109ecefd4484e7433dbdc0fe0ef8389f935e2b

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 07:00

Target

bb11b7cba17b5c0dd3f248a191109ecefd4484e7433dbdc0fe0ef8389f935e2b.dll
Size

19KB
MD5

6905617a2d3d8aba1c41339fdae54e00
SHA1

31b762c1607356ae933bf3b862cbfa180427437f
SHA256

bb11b7cba17b5c0dd3f248a191109ecefd4484e7433dbdc0fe0ef8389f935e2b
SHA512

7a08f0e047abec120b8c32ab05bff6bee53e60ee1c7409342c723cdfd844350750884d9f6c48eaf461da0e4d08111ae381b154db299d08e9f609e1484e3e564d
SSDEEP

384:C5vbsBZn2xaXmVFW6/DlmIJOEd0X1fdCGWH8B7Wo00P0r:C5ABZn2xEmLj/3dXEBT0Ws

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\37732D2F.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 4928	3708	rundll32.exe	83
PID 3708 wrote to memory of 4928	3708	rundll32.exe	83
PID 3708 wrote to memory of 4928	3708	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb11b7cba17b5c0dd3f248a191109ecefd4484e7433dbdc0fe0ef8389f935e2b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb11b7cba17b5c0dd3f248a191109ecefd4484e7433dbdc0fe0ef8389f935e2b.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:4928