a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:09

Target

a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9.dll
Size

120KB
MD5

639e85c0fb705c57a1701b4db6d831e0
SHA1

d9b56de6a37d207a6af2a51256b91e770ab33729
SHA256

a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9
SHA512

7b772ece6294964ef2b778a9b2fe5f6a19d1f5ce5c0dc31d0c312350cf9b957ddba2ed571ccb9c144f228fd5847a4670d95868a3a2a49b6db7ec91a00e5fbe40
SSDEEP

768:TdYZgFNCFD/XfScRlRJ7Dir/dOlBwK7iAlp3xix78ivYvaAy6kPC:54gPGWczjPOOlBw+lpBX1d

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26
PID 1976 wrote to memory of 1980	1976	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9.dll,#1
  2⤵
  PID:1980

memory/1980-55-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1980-56-0x0000000025000000-0x000000002501E000-memory.dmp

Filesize
120KB

Download