615770f2785bf7a219b6fe7094fa67ca4bc0e96aeb18318d5c11d55ee3c9725f

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 00:30

Target

615770f2785bf7a219b6fe7094fa67ca4bc0e96aeb18318d5c11d55ee3c9725f.dll
Size

51KB
MD5

53fa3be5f62ee736cad39dac8ce64c3e
SHA1

4000ec35eae9f65d1fddbe605cf32ba54bf52db0
SHA256

615770f2785bf7a219b6fe7094fa67ca4bc0e96aeb18318d5c11d55ee3c9725f
SHA512

58c41890a6911ad6871a8ab9adffa77b61a79b949231043b9dfb88d8571d7965f142d68aa3512f9098c0ef235488c19e08de62047d71486d468cb170ea8a1bc4
SSDEEP

768:3jkOznPbKe/1FZrDVAquMj8wtLuhHvfTOOYAEVJFe53Ja:/bN3DVAXMj8w+DLRJa

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1344	rundll32.exe
28	1344	rundll32.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\615770f2785bf7a219b6fe7094fa67ca4bc0e96aeb18318d5c11d55ee3c9725f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\615770f2785bf7a219b6fe7094fa67ca4bc0e96aeb18318d5c11d55ee3c9725f.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1344

memory/1344-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1344-56-0x0000000000940000-0x0000000000A16000-memory.dmp

Filesize
856KB

Download
memory/1344-57-0x0000000000940000-0x0000000000A16000-memory.dmp

Filesize
856KB

Download