f9763c5cb9896d1cb79aad06aeff38aeef279f8793dbd69a0dc1b2254f0d25db

Analysis

max time kernel
27s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 23:14

Target

f9763c5cb9896d1cb79aad06aeff38aeef279f8793dbd69a0dc1b2254f0d25db.dll
Size

156KB
MD5

0da7da60e4ca2cc38538ef0094d91420
SHA1

b404be1296426551b6d2faa805a5f8214af7b846
SHA256

f9763c5cb9896d1cb79aad06aeff38aeef279f8793dbd69a0dc1b2254f0d25db
SHA512

dc9e09201193e3a4727cb80d92d558d774f5c17bbd0404a3e2ab6c2306300331685c6a6ab745caa6f3f2b373463a5275f00dc8280b5f2cf67c6dae813926fe69
SSDEEP

3072:Wf8MPHB4ReEZx20XS30PHkwCqdZ8k8FfeaepDC01cJBG:W//B4DrimHiK8FfSq

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1492	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1492	1940	rundll32.exe	25
PID 1940 wrote to memory of 1492	1940	rundll32.exe	25
PID 1940 wrote to memory of 1492	1940	rundll32.exe	25
PID 1940 wrote to memory of 1492	1940	rundll32.exe	25
PID 1940 wrote to memory of 1492	1940	rundll32.exe	25
PID 1940 wrote to memory of 1492	1940	rundll32.exe	25
PID 1940 wrote to memory of 1492	1940	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9763c5cb9896d1cb79aad06aeff38aeef279f8793dbd69a0dc1b2254f0d25db.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9763c5cb9896d1cb79aad06aeff38aeef279f8793dbd69a0dc1b2254f0d25db.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492

memory/1492-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1492-56-0x0000000010000000-0x000000001008A000-memory.dmp

Filesize
552KB

Download