959d27ae3ef0ecf307da6fe08a6f105e07500ca3d9816cf19fecd878529db7f3

Analysis

max time kernel
151s
max time network
112s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 13:51

Target

959d27ae3ef0ecf307da6fe08a6f105e07500ca3d9816cf19fecd878529db7f3.dll
Size

101KB
MD5

672b51cdf3607f801cc98d66b294d6b0
SHA1

b05a40d37e41e1423b80b84420e079be20908fc8
SHA256

959d27ae3ef0ecf307da6fe08a6f105e07500ca3d9816cf19fecd878529db7f3
SHA512

cc43494914b75a245082326e6ad6fba6d5f05f151e3479fe99c233864d393ed033a6acd7b940d769c42800b18c1225ec386e2723f323b1bfb9bc7ea7f2ec30d4
SSDEEP

1536:YkSMScMwX+LxLeMVet5ozdKr1gRE5RyOFp878hKyWdA4IVifW:YRMRMu+sMVkoEr+OyObE8hKyWnNW

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
1	1696	rundll32.exe
3	1696	rundll32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\RUNDLL32.EXE-1696.txt	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1696	1000	rundll32.exe	27
PID 1000 wrote to memory of 1696	1000	rundll32.exe	27
PID 1000 wrote to memory of 1696	1000	rundll32.exe	27
PID 1000 wrote to memory of 1696	1000	rundll32.exe	27
PID 1000 wrote to memory of 1696	1000	rundll32.exe	27
PID 1000 wrote to memory of 1696	1000	rundll32.exe	27
PID 1000 wrote to memory of 1696	1000	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\959d27ae3ef0ecf307da6fe08a6f105e07500ca3d9816cf19fecd878529db7f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\959d27ae3ef0ecf307da6fe08a6f105e07500ca3d9816cf19fecd878529db7f3.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in Program Files directory
  PID:1696

memory/1696-55-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1696-56-0x000000000B000000-0x000000000B01F000-memory.dmp

Filesize
124KB

Download