94b6d10df190cb8ecd2b75af65433aac27978d1c4004561b08047ca2abdaf0f3

Analysis

max time kernel
8s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 06:01

Target

94b6d10df190cb8ecd2b75af65433aac27978d1c4004561b08047ca2abdaf0f3.dll
Size

44KB
MD5

5e59c761eb5600fc096d65432fdb6c11
SHA1

6f32e81191de8e68ad6b2787f02dd66c68864b75
SHA256

94b6d10df190cb8ecd2b75af65433aac27978d1c4004561b08047ca2abdaf0f3
SHA512

ac06a6e22586209ed874028c050b3197f9b1e2369f387fc8315b2534dcad655345b000038c7deb13c09f91c43aa58a89443a5382e4842c281b2e0a04f81ed3c5
SSDEEP

384:D2y6K867Tn9i6+Xiyo07PEWUJOoH8HoI0I/YDLtuSAPcWPnofgULnYHKh:o967Tn91+SjXQoHy7YDLtiPno2M

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2044	rundll32.exe
2044	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2044	1904	rundll32.exe	28
PID 1904 wrote to memory of 2044	1904	rundll32.exe	28
PID 1904 wrote to memory of 2044	1904	rundll32.exe	28
PID 1904 wrote to memory of 2044	1904	rundll32.exe	28
PID 1904 wrote to memory of 2044	1904	rundll32.exe	28
PID 1904 wrote to memory of 2044	1904	rundll32.exe	28
PID 1904 wrote to memory of 2044	1904	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\94b6d10df190cb8ecd2b75af65433aac27978d1c4004561b08047ca2abdaf0f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\94b6d10df190cb8ecd2b75af65433aac27978d1c4004561b08047ca2abdaf0f3.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044

memory/2044-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download