27db2874dc0a29a2963fad809a08e921e58802af6c9bbbff086708f4dac2ee70

Analysis

max time kernel
144s
max time network
133s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28-10-2022 18:10

Target

4bd658865f0a2e7174af17b9e18c46221121c758652becff8467312eba384e39.dll
Size

73KB
MD5

20e67a9db9188f4d84171158b445cc7f
SHA1

db868afc182e5b1e1b44f9935eba474c20039eaf
SHA256

4bd658865f0a2e7174af17b9e18c46221121c758652becff8467312eba384e39
SHA512

7aca5e6a2149903b9698a3b9270537f9187a1a0e7205fb3c2ce1a8d6e214f9dbf0e0009731af4bb734245b55917fdc759c9086d28369244eeafe2a624da531b0
SSDEEP

1536:PyzU3TKk+QNFZoS5Vz0BDz4CPMZPoBmK+YFrO:AU3ToQNFZ3bz0B/kZPQ+kO

Score

7^/10

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 996 set thread context of 1968	996	rundll32.exe	28

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 996	1720	rundll32.exe	27
PID 1720 wrote to memory of 996	1720	rundll32.exe	27
PID 1720 wrote to memory of 996	1720	rundll32.exe	27
PID 1720 wrote to memory of 996	1720	rundll32.exe	27
PID 1720 wrote to memory of 996	1720	rundll32.exe	27
PID 1720 wrote to memory of 996	1720	rundll32.exe	27
PID 1720 wrote to memory of 996	1720	rundll32.exe	27
PID 996 wrote to memory of 1968	996	rundll32.exe	28
PID 996 wrote to memory of 1968	996	rundll32.exe	28
PID 996 wrote to memory of 1968	996	rundll32.exe	28
PID 996 wrote to memory of 1968	996	rundll32.exe	28
PID 996 wrote to memory of 1968	996	rundll32.exe	28
PID 996 wrote to memory of 1968	996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bd658865f0a2e7174af17b9e18c46221121c758652becff8467312eba384e39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bd658865f0a2e7174af17b9e18c46221121c758652becff8467312eba384e39.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\SysWOW64\dllhost.exe
    C:\Windows\system32\dllhost.exe
    3⤵
    PID:1968

memory/996-54-0x0000000000000000-mapping.dmp

Download
memory/996-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1968-56-0x0000000000070000-0x0000000000084000-memory.dmp

Filesize
80KB

Download
memory/1968-58-0x0000000000070000-0x0000000000084000-memory.dmp

Filesize
80KB

Download
memory/1968-62-0x0000000000070000-0x0000000000084000-memory.dmp

Filesize
80KB

Download
memory/1968-59-0x0000000000078280-mapping.dmp

Download
memory/1968-63-0x0000000000070000-0x0000000000084000-memory.dmp

Filesize
80KB

Download