f795f9a2e2ee358a4a1ac5b8980be60ea9492e641068e8338ff0daf84260c5a1

Analysis

max time kernel
19s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 03:26

Target

f795f9a2e2ee358a4a1ac5b8980be60ea9492e641068e8338ff0daf84260c5a1.dll
Size

166KB
MD5

6ec76bb7985798b3db9e547b0cc44060
SHA1

81129575d5f4b1db18ad494d5c4ef24cff6ef5c2
SHA256

f795f9a2e2ee358a4a1ac5b8980be60ea9492e641068e8338ff0daf84260c5a1
SHA512

2d58596a79e00ed828e713077688b0053cefdaf5fd4062c070367ad8278e94cd6a16ba40444abfcaf23774811d1502f1f94dd1fb2880adaa3a047587f9252a33
SSDEEP

1536:9cI1e7iPEfxRXqQxPvFE/doYWG9zNWS3Qq5zl5RHar7Ok+ElKZjwSPQ+00OwPFz:9cqE4QxP9E79zNfXxl51027rPZa8geE

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
932	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 932	1072	rundll32.exe	27
PID 1072 wrote to memory of 932	1072	rundll32.exe	27
PID 1072 wrote to memory of 932	1072	rundll32.exe	27
PID 1072 wrote to memory of 932	1072	rundll32.exe	27
PID 1072 wrote to memory of 932	1072	rundll32.exe	27
PID 1072 wrote to memory of 932	1072	rundll32.exe	27
PID 1072 wrote to memory of 932	1072	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f795f9a2e2ee358a4a1ac5b8980be60ea9492e641068e8338ff0daf84260c5a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f795f9a2e2ee358a4a1ac5b8980be60ea9492e641068e8338ff0daf84260c5a1.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:932

memory/932-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/932-56-0x0000000074A10000-0x0000000074A56000-memory.dmp

Filesize
280KB

Download
memory/932-57-0x0000000074A10000-0x0000000074A56000-memory.dmp

Filesize
280KB

Download
memory/932-58-0x0000000074A10000-0x0000000074A56000-memory.dmp

Filesize
280KB

Download