ab8a9df5524a07c4d4a7d3cdf5335e13ff2faee6e96c2412c8e632cdae751fea

Analysis

max time kernel
74s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:48

Target

ab8a9df5524a07c4d4a7d3cdf5335e13ff2faee6e96c2412c8e632cdae751fea.dll
Size

20KB
MD5

42da8fd934c0b32c90e71175ca45caf4
SHA1

07fcaee505a450e43a902f8cd03e8b1e0c479571
SHA256

ab8a9df5524a07c4d4a7d3cdf5335e13ff2faee6e96c2412c8e632cdae751fea
SHA512

0e7ca070272dd1cab5ecc9238b7a6a75a06f15ff7e530ffc2f9513fa3ba87690a4d4075deb85a2818389bd35b08192176f4e1e473b511d163807de0c700fd68a
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0XplPCAu8UaWHuqaTlX0wG:zfYh2oCtpXPPx2OqaewG

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

544 rundll32.exe

pid	process
544	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1008 wrote to memory of 544	1008	rundll32.exe	rundll32.exe
PID 1008 wrote to memory of 544	1008	rundll32.exe	rundll32.exe
PID 1008 wrote to memory of 544	1008	rundll32.exe	rundll32.exe
PID 1008 wrote to memory of 544	1008	rundll32.exe	rundll32.exe
PID 1008 wrote to memory of 544	1008	rundll32.exe	rundll32.exe
PID 1008 wrote to memory of 544	1008	rundll32.exe	rundll32.exe
PID 1008 wrote to memory of 544	1008	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab8a9df5524a07c4d4a7d3cdf5335e13ff2faee6e96c2412c8e632cdae751fea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1008

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab8a9df5524a07c4d4a7d3cdf5335e13ff2faee6e96c2412c8e632cdae751fea.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:544

memory/544-54-0x0000000000000000-mapping.dmp

Download
memory/544-55-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download