a1e365c7bd3d2f9c63344b5038d48633edde3f7385f1d39231137621129dd52d

Analysis

max time kernel
12s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:30

Target

a1e365c7bd3d2f9c63344b5038d48633edde3f7385f1d39231137621129dd52d.dll
Size

330KB
MD5

bbd01424845abbfefd9bc05420684d92
SHA1

7bf4f61ef99c2f2bc79f46d457467cf531e1828d
SHA256

a1e365c7bd3d2f9c63344b5038d48633edde3f7385f1d39231137621129dd52d
SHA512

ee9ac333beb021785661aefc1e1e028481a4fca75fa2632517d53491a3c7526748465edaa41747c2e5869b4ea1aa2e2efc28071d365a50065848b2727aabedea
SSDEEP

6144:ylDldPOqoFmiYrO7bd/AssiDbu+2/zztPt/0HEZETtPnJj907z7:ylDldOIO/hN/Klq+stPnm

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

316 rundll32.exe

pid	process
316	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2012 wrote to memory of 316	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 316	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 316	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 316	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 316	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 316	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 316	2012	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1e365c7bd3d2f9c63344b5038d48633edde3f7385f1d39231137621129dd52d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1e365c7bd3d2f9c63344b5038d48633edde3f7385f1d39231137621129dd52d.dll,#1
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:316

memory/316-54-0x0000000000000000-mapping.dmp

Download
memory/316-55-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download
memory/316-56-0x0000000001BB0000-0x0000000001C75000-memory.dmp

Filesize
788KB

Download