f7af195b4a3b031b80afec71eef4bbdd89d85ff94b30c42eecb0eef953c0a930

Analysis

max time kernel
36s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 05:39

Target

f7af195b4a3b031b80afec71eef4bbdd89d85ff94b30c42eecb0eef953c0a930.dll
Size

132KB
MD5

ad120b19aa5805b07a635661218ad303
SHA1

81d80591b3ddfc2f0a3804f6fe42ecd31d8c9aac
SHA256

f7af195b4a3b031b80afec71eef4bbdd89d85ff94b30c42eecb0eef953c0a930
SHA512

8ed14c829993ffcd652dee709e67eebd5b3a5ca98fb93221b6b994eb17daefb7ecf6e54d04dc39b51921a1b6971adec3f94a9ad0f0a4aad557da5a32daad633b
SSDEEP

3072:s+bXk/mO37vr+maHmCHv020AQZALiwnC6EQYOe1:tDO3ubyAQZAmwny

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1772	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7af195b4a3b031b80afec71eef4bbdd89d85ff94b30c42eecb0eef953c0a930.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7af195b4a3b031b80afec71eef4bbdd89d85ff94b30c42eecb0eef953c0a930.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:1772

memory/1772-55-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/1772-56-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/1772-57-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download