c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1

Analysis

max time kernel
184s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 22:51

Target

c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1.dll
Size

20KB
MD5

992f77c3ec4aa10a245f6614c9499573
SHA1

d42ab0987affc0c6c5b16569972efa810db1eb0a
SHA256

c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1
SHA512

cd403d55ca3e6e98358c73c2d663c9a8bde4e2f6f38d69e7aac536873d1e8452f90fd6502eb73819fd132c0a5ddc2c2492a0df6b9ce8cc4a776a960208995cf5
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0XpliCAu8UaWHuqaTlX0wG:zfYh2oCtpXPix2OqaewG

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
3076	rundll32.exe
3076	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3076	4580	rundll32.exe	74
PID 4580 wrote to memory of 3076	4580	rundll32.exe	74
PID 4580 wrote to memory of 3076	4580	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9bee0548ad4c1f118eb72cc837157e0850229b38594d724fe3951c86fda76b1.dll,#1
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3076

C:\Users\Admin\AppData\Local\Temp\6699.tmp

Filesize
20KB

MD5
117f16351b445084b858ae674c318fd8

SHA1
47ca3021104d7dbe5543d06d3e07855155f879d3

SHA256
7ccdfae499703257e3ef2638ede2ef98297a87ad5866f028c8afe28756a77b22

SHA512
41ffd45a75d6add2c0f20a38ab9f7290484c357d343e838111471ab73a172e43fff3d994ac23ec5c2baa11c261f45dbdfad814866144d98a56159d087bd701ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\6699.tmp

Filesize
20KB

MD5
117f16351b445084b858ae674c318fd8

SHA1
47ca3021104d7dbe5543d06d3e07855155f879d3

SHA256
7ccdfae499703257e3ef2638ede2ef98297a87ad5866f028c8afe28756a77b22

SHA512
41ffd45a75d6add2c0f20a38ab9f7290484c357d343e838111471ab73a172e43fff3d994ac23ec5c2baa11c261f45dbdfad814866144d98a56159d087bd701ad

Download Submit
memory/3076-135-0x0000000001591000-0x0000000001593000-memory.dmp

Filesize
8KB

Download