d96b7d3e5b78844e4d63381ea64def1517f470ef7716df9586e75fdf6a58c20d

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:33

Target

d96b7d3e5b78844e4d63381ea64def1517f470ef7716df9586e75fdf6a58c20d.dll
Size

79KB
MD5

c43f173ba50158d0bc716cc7900c9bd6
SHA1

8036c683f7bd937447cf9e72d94abeb5bceb9cb4
SHA256

d96b7d3e5b78844e4d63381ea64def1517f470ef7716df9586e75fdf6a58c20d
SHA512

2b433b5a71ad62de441aecc6a57f80b1bbd6fa326f0f7eeebafcb402657468e7696adfd8c32343d3db5fa23a81b40a7d8c3ad404676073f1ef4f81d059ef4419
SSDEEP

768:VhAR0QxZn6x2fa3YCYaEeZhJ6W8nciSljIQl/hmeAZL7ScXN7Xp72hJxqm8E5S1p:VhAln6fjYuvec/GQUZSAXp72hJxqm/5o

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2028	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d96b7d3e5b78844e4d63381ea64def1517f470ef7716df9586e75fdf6a58c20d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d96b7d3e5b78844e4d63381ea64def1517f470ef7716df9586e75fdf6a58c20d.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

memory/2028-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download