21cec264e25ecd068677c642021ab85a39af414ec1038e7a34c087dc6f9a3c23

Analysis

max time kernel
36s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:02

Target

21cec264e25ecd068677c642021ab85a39af414ec1038e7a34c087dc6f9a3c23.dll
Size

380KB
MD5

25e952c352c071938e11922b7e8b1bf7
SHA1

12ee57e0ee4e87dc5fe2d1b647ca277efccceb28
SHA256

21cec264e25ecd068677c642021ab85a39af414ec1038e7a34c087dc6f9a3c23
SHA512

5f3bfd626c4551e9051ca973bb638775b8c1f842d7780acd486361405a8ed8c303b6a01bb3e3e6369c1eb103d591389df5b7a293437a88aebc4c3fbdc4c4135d
SSDEEP

6144:iu7GpiAU4d/FgXb1SNfuvCLDVxvWRSG+ctTaZnGj6hLpai9l0732AYms3cfHQKUr:iu7GpI4dt8bk9uvO6wG+AaZBa32z5uHS

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

1596 rundll32.exe

pid	process
1596	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 960 wrote to memory of 1596	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1596	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1596	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1596	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1596	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1596	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1596	960	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21cec264e25ecd068677c642021ab85a39af414ec1038e7a34c087dc6f9a3c23.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21cec264e25ecd068677c642021ab85a39af414ec1038e7a34c087dc6f9a3c23.dll,#1
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1596

memory/1596-54-0x0000000000000000-mapping.dmp

Download
memory/1596-55-0x0000000075001000-0x0000000075003000-memory.dmp

Filesize
8KB

Download
memory/1596-56-0x0000000010000000-0x0000000010063000-memory.dmp

Filesize
396KB

Download
memory/1596-57-0x0000000002461000-0x0000000002471000-memory.dmp

Filesize
64KB

Download