e184aa056f08ffde4783fef66a1ee41240d810d780c03ce8a803fae1808b6616

Analysis

max time kernel
13s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 10:27

Target

e184aa056f08ffde4783fef66a1ee41240d810d780c03ce8a803fae1808b6616.dll
Size

67KB
MD5

b4e365f79edf98d7424d8f464603d311
SHA1

55abd44e504c13294bb207f78e3cb0852a736e42
SHA256

e184aa056f08ffde4783fef66a1ee41240d810d780c03ce8a803fae1808b6616
SHA512

6379f2359b5610f8c91b7979a37d7d97bb4bc48c9bbd56ebc87f6aaa103a20d547d31ce3a0b2e343033ebdd0433ec3a58e7cbb73036c32b09f31831b1a7b6515
SSDEEP

1536:PJkeBFUCFsAzoJn8AiSc9ahtfvqWXUeXBsHrIIJHjQj2:RLBHA1iS77/UeiLIIJHsj2

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2016	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 2016	896	rundll32.exe	28
PID 896 wrote to memory of 2016	896	rundll32.exe	28
PID 896 wrote to memory of 2016	896	rundll32.exe	28
PID 896 wrote to memory of 2016	896	rundll32.exe	28
PID 896 wrote to memory of 2016	896	rundll32.exe	28
PID 896 wrote to memory of 2016	896	rundll32.exe	28
PID 896 wrote to memory of 2016	896	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e184aa056f08ffde4783fef66a1ee41240d810d780c03ce8a803fae1808b6616.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e184aa056f08ffde4783fef66a1ee41240d810d780c03ce8a803fae1808b6616.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016

memory/2016-54-0x0000000000000000-mapping.dmp

Download
memory/2016-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download