b31ebf17f10adb718695bd432ac2bd8006875c3547012471b5bb98fd031fdada

Analysis

max time kernel
13s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 21:34

Target

b31ebf17f10adb718695bd432ac2bd8006875c3547012471b5bb98fd031fdada.dll
Size

20KB
MD5

c647d48ed976640c62bcf5b30025441f
SHA1

8bfab0ecf668659287d12f452664b9efc4d8c9bd
SHA256

b31ebf17f10adb718695bd432ac2bd8006875c3547012471b5bb98fd031fdada
SHA512

e407dacea5f16a524be01244704471d97e6d5d9c92dd9ad67a8caf5b252ed3702b6427040e8ec9e99f8860ddf850a014d2538c09f08e2ec630aeb2f5b21f9f11
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0Xpl8CAu8UaWHuqaTlX0wG:zfYh2oCtpXP8x2OqaewG

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1372	rundll32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1372	1368	rundll32.exe	28
PID 1368 wrote to memory of 1372	1368	rundll32.exe	28
PID 1368 wrote to memory of 1372	1368	rundll32.exe	28
PID 1368 wrote to memory of 1372	1368	rundll32.exe	28
PID 1368 wrote to memory of 1372	1368	rundll32.exe	28
PID 1368 wrote to memory of 1372	1368	rundll32.exe	28
PID 1368 wrote to memory of 1372	1368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b31ebf17f10adb718695bd432ac2bd8006875c3547012471b5bb98fd031fdada.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b31ebf17f10adb718695bd432ac2bd8006875c3547012471b5bb98fd031fdada.dll,#1
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1372

\Users\Admin\AppData\Local\Temp\4B25.tmp

Filesize
20KB

MD5
e43ff8faf63cf4962799be767cd6c539

SHA1
78500ffe81e9e9866df75a779f4ee18789636421

SHA256
0b7a07ca52f4ae8fdbf82319a35b0f4493e1db6ce849bb59abaefb26a81c9f94

SHA512
56e0ab5966b137bac6ff0b9af2fcaf73f03c69c4eca2ded3af8de986aae4d8004db9c82f7f2ee68cbebfa2f8ed811939ec5a2316a7cc9c1397f29a5692466ae1

Download Submit
memory/1372-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download