b63de21da89b013fe7607a330f40b37048f10cbddbe527ed05efabc7536b9220

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 18:12

Target

b63de21da89b013fe7607a330f40b37048f10cbddbe527ed05efabc7536b9220.dll
Size

44KB
MD5

6d4c7996663e4a3950eecaff0fc6f9f6
SHA1

1a5029b881fc3407a84c6b0ab97734a13ca99729
SHA256

b63de21da89b013fe7607a330f40b37048f10cbddbe527ed05efabc7536b9220
SHA512

b6b3215661fbe666ef4aaeab7f44bab5d755dbaa1b71fa189bfb33df7ca74f3e33aa402baabc18c871c6fd04dbeed3e070f328d2fc05cec0945809f4e05a4487
SSDEEP

384:D2y6K867Tn9i6+Xiyo07PEWUJOoH8HoI0I/YDLtuSAPcWPnofgULnYHKf:o967Tn91+SjXQoHy7YDLtiPno2u

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1188	rundll32.exe
1188	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1188	1060	rundll32.exe	27
PID 1060 wrote to memory of 1188	1060	rundll32.exe	27
PID 1060 wrote to memory of 1188	1060	rundll32.exe	27
PID 1060 wrote to memory of 1188	1060	rundll32.exe	27
PID 1060 wrote to memory of 1188	1060	rundll32.exe	27
PID 1060 wrote to memory of 1188	1060	rundll32.exe	27
PID 1060 wrote to memory of 1188	1060	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b63de21da89b013fe7607a330f40b37048f10cbddbe527ed05efabc7536b9220.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b63de21da89b013fe7607a330f40b37048f10cbddbe527ed05efabc7536b9220.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188

memory/1188-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download