349a614d90eccb5175c05206e91207e73ff718256d353d01bc636293ae1c35de

Analysis

max time kernel
90s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2022, 05:50

Target

349a614d90eccb5175c05206e91207e73ff718256d353d01bc636293ae1c35de.dll
Size

2.1MB
MD5

2ded69270474d0ab7f57baf535692422
SHA1

0c1b5af07ae094c77a73efbb7fc719c628667f31
SHA256

349a614d90eccb5175c05206e91207e73ff718256d353d01bc636293ae1c35de
SHA512

e139da6a0949b8971046736f7a421c51f17193aec60d20121730ab3857ca643eefda8b87dd637f62a018ea07e995d655e24b047e99110150e67bd0d35d110a7e
SSDEEP

24576:L8BM8BHeRhUnC/pvBJRnM8cf2OAiTMK6vveFP7+3E9tOVX8NSMUcsZF8GWqdQjWA:bYHc+AjiTMDekUsX8NSncsZeALnPI

Score

4^/10

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SmartCloudInput\1.1.0.0511\SmartCloudInfo.ini	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of FindShellTrayWindow 24 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 4636	2952	rundll32.exe	80
PID 2952 wrote to memory of 4636	2952	rundll32.exe	80
PID 2952 wrote to memory of 4636	2952	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\349a614d90eccb5175c05206e91207e73ff718256d353d01bc636293ae1c35de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\349a614d90eccb5175c05206e91207e73ff718256d353d01bc636293ae1c35de.dll,#1
  2⤵
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:4636