0d459e5fed3b8297e98ae70e45203bafac0a0f8a0ff572ea6c94bc353d4bd522

Analysis

max time kernel
242s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 14:33

Target

0d459e5fed3b8297e98ae70e45203bafac0a0f8a0ff572ea6c94bc353d4bd522.dll
Size

125KB
MD5

fb4ddf47fe9ee8bdc4c2c3fe979c6800
SHA1

662fd36ea8635f95e9332c580d70445e589a4b75
SHA256

0d459e5fed3b8297e98ae70e45203bafac0a0f8a0ff572ea6c94bc353d4bd522
SHA512

14c5e570afa13d633dbd8c194c5fc7a6ccb96431dc254cb38bb92bc69a7103c55619e3e38a7daaa96266a3e76bea5dd0641f997b3a953cb934abc894b74dfa3b
SSDEEP

1536:nsdmguQ8rv/jbj/mFomnMV3oX4ShLtJrJAjfDfYXlfl:ns9p8rv/3VWMeLtJ+jfDfYXl

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1504	dc.exe

Loads dropped DLL 1 IoCs

pid	Process
556	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 556	1648	rundll32.exe	28
PID 1648 wrote to memory of 556	1648	rundll32.exe	28
PID 1648 wrote to memory of 556	1648	rundll32.exe	28
PID 1648 wrote to memory of 556	1648	rundll32.exe	28
PID 1648 wrote to memory of 556	1648	rundll32.exe	28
PID 1648 wrote to memory of 556	1648	rundll32.exe	28
PID 1648 wrote to memory of 556	1648	rundll32.exe	28
PID 556 wrote to memory of 1504	556	rundll32.exe	29
PID 556 wrote to memory of 1504	556	rundll32.exe	29
PID 556 wrote to memory of 1504	556	rundll32.exe	29
PID 556 wrote to memory of 1504	556	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d459e5fed3b8297e98ae70e45203bafac0a0f8a0ff572ea6c94bc353d4bd522.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d459e5fed3b8297e98ae70e45203bafac0a0f8a0ff572ea6c94bc353d4bd522.dll,#1
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Users\Admin\AppData\Local\Temp\dc.exe
    C:\Users\Admin\AppData\Local\Temp\dc.exe
    3⤵
    - Executes dropped EXE
    PID:1504

C:\Users\Admin\AppData\Local\Temp\dc.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\Users\Admin\AppData\Local\Temp\dc.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
memory/556-55-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download