349a614d90eccb5175c05206e91207e73ff718256d353d01bc636293ae1c35de

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 05:50

Target

349a614d90eccb5175c05206e91207e73ff718256d353d01bc636293ae1c35de.dll
Size

2.1MB
MD5

2ded69270474d0ab7f57baf535692422
SHA1

0c1b5af07ae094c77a73efbb7fc719c628667f31
SHA256

349a614d90eccb5175c05206e91207e73ff718256d353d01bc636293ae1c35de
SHA512

e139da6a0949b8971046736f7a421c51f17193aec60d20121730ab3857ca643eefda8b87dd637f62a018ea07e995d655e24b047e99110150e67bd0d35d110a7e
SSDEEP

24576:L8BM8BHeRhUnC/pvBJRnM8cf2OAiTMK6vveFP7+3E9tOVX8NSMUcsZF8GWqdQjWA:bYHc+AjiTMDekUsX8NSncsZeALnPI

Score

4^/10

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SmartCloudInput\1.1.0.0511\SmartCloudInfo.ini	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	rundll32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of FindShellTrayWindow 24 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1324	1644	rundll32.exe	28
PID 1644 wrote to memory of 1324	1644	rundll32.exe	28
PID 1644 wrote to memory of 1324	1644	rundll32.exe	28
PID 1644 wrote to memory of 1324	1644	rundll32.exe	28
PID 1644 wrote to memory of 1324	1644	rundll32.exe	28
PID 1644 wrote to memory of 1324	1644	rundll32.exe	28
PID 1644 wrote to memory of 1324	1644	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\349a614d90eccb5175c05206e91207e73ff718256d353d01bc636293ae1c35de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\349a614d90eccb5175c05206e91207e73ff718256d353d01bc636293ae1c35de.dll,#1
  2⤵
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:1324

memory/1324-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download