bcd9adc1fdd8b40edc6662e9834464fcf2c236efb177b037bff09b810009b118

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 06:06

Target

bcd9adc1fdd8b40edc6662e9834464fcf2c236efb177b037bff09b810009b118.dll
Size

24KB
MD5

9ecbd385a870fff5012647fd51d1c0a5
SHA1

41345efda011931c3da8c848185569b2bd86829d
SHA256

bcd9adc1fdd8b40edc6662e9834464fcf2c236efb177b037bff09b810009b118
SHA512

5c80f3fecdbd3c7f286bb0fb728bf58d491a6d338b3a38141b8a3451adbad6e86d89d58e5047fd04dc9762df039ca5205c553c5ed2744abda945d3a1a647a851
SSDEEP

192:eIH0L5h0CDehzsHSXyHAcR/iElcB7uoV1BYFzN8r:+cHyHAc1/lcpuIsFzNC

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\kasgfka.dll	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcd9adc1fdd8b40edc6662e9834464fcf2c236efb177b037bff09b810009b118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcd9adc1fdd8b40edc6662e9834464fcf2c236efb177b037bff09b810009b118.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:1516

memory/1516-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1516-56-0x0000000068080000-0x0000000068086000-memory.dmp

Filesize
24KB

Download