4d8bf34714f32ef05e7252505665efd87ab4d842738d834aab522d8b8f4b4993

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 18:22

Target

4d8bf34714f32ef05e7252505665efd87ab4d842738d834aab522d8b8f4b4993.dll
Size

69KB
MD5

80627083da1784f4b5fbc4a584ee1dd9
SHA1

770cd356c1fc244dacc4c61b8e46cfd7013a8e60
SHA256

4d8bf34714f32ef05e7252505665efd87ab4d842738d834aab522d8b8f4b4993
SHA512

9ac5f5b808a49767357d48f67763ab997e6c4817160e9acd594a463346d25cb0af071c3e6c0e4072d01202edfc60f7e2024fcf2740f5d5899f991a7611a541e6
SSDEEP

1536:oUUmZ6gSi9/wx9+krA3XYVBAV/qNDuVb16yMNk7oPwhkLagPt:o2gg8E53IHS2DsboyMNk7Ewhiagl

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\oeqmouel.rqt	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\oeqmouel.rqt	rundll32.exe
File created	C:\Windows\SysWOW64\mqrbjqgx.whb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\mqrbjqgx.whb	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d8bf34714f32ef05e7252505665efd87ab4d842738d834aab522d8b8f4b4993.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d8bf34714f32ef05e7252505665efd87ab4d842738d834aab522d8b8f4b4993.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:944

memory/944-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/944-59-0x0000000000140000-0x000000000015C000-memory.dmp

Filesize
112KB

Download
memory/944-61-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/944-62-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/944-63-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/944-64-0x0000000000140000-0x000000000015C000-memory.dmp

Filesize
112KB

Download