b0bc39c240f411ba476504303d4c2271da3e6506a1305f05e74b6886dedd6285

Analysis

max time kernel
32s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 22:52

Target

b0bc39c240f411ba476504303d4c2271da3e6506a1305f05e74b6886dedd6285.dll
Size

20KB
MD5

db45d1e6ef1e6e8f8f249b6823a44642
SHA1

b5ad2cc9b73f1e917954dc2b4f4e048eb7dd37dd
SHA256

b0bc39c240f411ba476504303d4c2271da3e6506a1305f05e74b6886dedd6285
SHA512

bd66ca6433a62d0ccdc91e2338c24cea5d948fc67aea0df28372f505ba1abed0f8171a0a010893ee0a7a5a26dcf15a6ad35b63bd93804547b35effcfe3f4d7a3
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0XplA8CAu8UaWHuqaTlX0wG:zfYh2oCtpXP7x2OqaewG

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1368	rundll32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1368	1008	rundll32.exe	28
PID 1008 wrote to memory of 1368	1008	rundll32.exe	28
PID 1008 wrote to memory of 1368	1008	rundll32.exe	28
PID 1008 wrote to memory of 1368	1008	rundll32.exe	28
PID 1008 wrote to memory of 1368	1008	rundll32.exe	28
PID 1008 wrote to memory of 1368	1008	rundll32.exe	28
PID 1008 wrote to memory of 1368	1008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0bc39c240f411ba476504303d4c2271da3e6506a1305f05e74b6886dedd6285.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0bc39c240f411ba476504303d4c2271da3e6506a1305f05e74b6886dedd6285.dll,#1
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1368

\Users\Admin\AppData\Local\Temp\2119.tmp

Filesize
20KB

MD5
b81ee9650b6d0e2d375d3ea251c64585

SHA1
93d4ac6aa0055e20b3c67f430355105e408546f2

SHA256
faff0cf1d65443cfdb1784dc0eefe70a4766424fa15b22997f5e35901c1b62d6

SHA512
a3dc2eb5cd84144dc0d2ebd84170b712a4e4bae5820aaebe7baf095d7d60282a75a0330dec14af8655393ee75e61916e280431275114f88f9d580f4e4fbd0fcc

Download Submit
memory/1368-55-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download