53d669a076616723136d93d74ab3605a39de870238d0cada50d3a7d2eb955435

Analysis

max time kernel
37s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:06

Target

53d669a076616723136d93d74ab3605a39de870238d0cada50d3a7d2eb955435.dll
Size

639KB
MD5

d4821ef66a71768ffbcf390cbabcdca0
SHA1

653b0c0c244846a961c6034d02cd97c3fec6458b
SHA256

53d669a076616723136d93d74ab3605a39de870238d0cada50d3a7d2eb955435
SHA512

a8ca5f479c77c6da48a13e71eed8a698368a2da8c12cab8aa8de50a5f24dc0467f5a97aab21f07c1dfbb2548a78bf9c27f9672ab8052fbb33c92ce9cd872132e
SSDEEP

12288:PfVHLSX/d9bIxpyWmfA33EVdawVrdylKNdWGG44yw5WVZaHIrhAlEfx:dwdKyWmfA3UVoaJylKNaHuh

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

1 956 rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

956 rundll32.exe

flow	pid	process
1	956	rundll32.exe

pid	process
956	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 956	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 956	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 956	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 956	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 956	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 956	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 956	2040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53d669a076616723136d93d74ab3605a39de870238d0cada50d3a7d2eb955435.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

memory/956-54-0x0000000000000000-mapping.dmp

Download
memory/956-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/956-56-0x0000000000670000-0x0000000000685000-memory.dmp

Filesize
84KB

Download
memory/956-57-0x0000000001D30000-0x0000000001E71000-memory.dmp

Filesize
1.3MB

Download