e3324b75fd993386d9f6f160fd3b0adce3c7e02d01090b792670ba7faf72ce3d

Analysis

max time kernel
173s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 13:34

Target

e3324b75fd993386d9f6f160fd3b0adce3c7e02d01090b792670ba7faf72ce3d.dll
Size

220KB
MD5

b4e2f6d110630458d56964393fe4cb0e
SHA1

918dee83a0b8063e42671d73f19dedb16229214d
SHA256

e3324b75fd993386d9f6f160fd3b0adce3c7e02d01090b792670ba7faf72ce3d
SHA512

026315cbf5e6a8aaf8811264ca0894c97371529b320975affa54bbd56668a50d85a05161a911b376bfda5397a82847ef009eadfb292730bbd0058e71ea51a280
SSDEEP

3072:nk82AssKXtIhnkA94zcLsvQ+tnwiSHLN3sabSrUqt6hnSiy:nk89HozcLswiKbSY

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\wdmaud.drv	rundll32.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
676	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 676	1872	rundll32.exe	80
PID 1872 wrote to memory of 676	1872	rundll32.exe	80
PID 1872 wrote to memory of 676	1872	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3324b75fd993386d9f6f160fd3b0adce3c7e02d01090b792670ba7faf72ce3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3324b75fd993386d9f6f160fd3b0adce3c7e02d01090b792670ba7faf72ce3d.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:676