e3324b75fd993386d9f6f160fd3b0adce3c7e02d01090b792670ba7faf72ce3d

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 13:34

Target

e3324b75fd993386d9f6f160fd3b0adce3c7e02d01090b792670ba7faf72ce3d.dll
Size

220KB
MD5

b4e2f6d110630458d56964393fe4cb0e
SHA1

918dee83a0b8063e42671d73f19dedb16229214d
SHA256

e3324b75fd993386d9f6f160fd3b0adce3c7e02d01090b792670ba7faf72ce3d
SHA512

026315cbf5e6a8aaf8811264ca0894c97371529b320975affa54bbd56668a50d85a05161a911b376bfda5397a82847ef009eadfb292730bbd0058e71ea51a280
SSDEEP

3072:nk82AssKXtIhnkA94zcLsvQ+tnwiSHLN3sabSrUqt6hnSiy:nk89HozcLswiKbSY

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\wdmaud.drv	rundll32.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1664	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1664	1100	rundll32.exe	27
PID 1100 wrote to memory of 1664	1100	rundll32.exe	27
PID 1100 wrote to memory of 1664	1100	rundll32.exe	27
PID 1100 wrote to memory of 1664	1100	rundll32.exe	27
PID 1100 wrote to memory of 1664	1100	rundll32.exe	27
PID 1100 wrote to memory of 1664	1100	rundll32.exe	27
PID 1100 wrote to memory of 1664	1100	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3324b75fd993386d9f6f160fd3b0adce3c7e02d01090b792670ba7faf72ce3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3324b75fd993386d9f6f160fd3b0adce3c7e02d01090b792670ba7faf72ce3d.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:1664

memory/1664-55-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download