076caa3f9400f8ef68fc52c9ab30583ab93e1040267252d5a2f4f2f70a391a3c

Analysis

max time kernel
184s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:48

Target

076caa3f9400f8ef68fc52c9ab30583ab93e1040267252d5a2f4f2f70a391a3c.dll
Size

12KB
MD5

55ddbed230f4ed9edc570c7330bcec00
SHA1

44eb85027847f0beabdf43ec1c57df422568a489
SHA256

076caa3f9400f8ef68fc52c9ab30583ab93e1040267252d5a2f4f2f70a391a3c
SHA512

0dc5c87c55ebf1d3fc0a67e803ad385c7968cda740a4082c086faa9161f866cfa33ad34e1ab7d3e7af3bdd6aea7282e76854eb855310bd6e62942f5f580df0f3
SSDEEP

384:gRwXtXjLXEIzZbrn/7m9KcT00XJPAHKWH8B7WI:J9XjLXEwbriA7oB/

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\27652E15.sys rundll32.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

660

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\27652E15.sys	rundll32.exe

pid	process
660

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3176 wrote to memory of 1256	3176	rundll32.exe	rundll32.exe
PID 3176 wrote to memory of 1256	3176	rundll32.exe	rundll32.exe
PID 3176 wrote to memory of 1256	3176	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\076caa3f9400f8ef68fc52c9ab30583ab93e1040267252d5a2f4f2f70a391a3c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3176

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\076caa3f9400f8ef68fc52c9ab30583ab93e1040267252d5a2f4f2f70a391a3c.dll,#1
2⤵
- Drops file in System32 directory
PID:1256