ad3049942127babb8f9423cbe104ef3d78a6cece3e5f7774df401df99ae9962a

Analysis

max time kernel
3s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 09:13

Target

ad3049942127babb8f9423cbe104ef3d78a6cece3e5f7774df401df99ae9962a.dll
Size

42KB
MD5

67967dd81ce534f3379c8fc3f4d3586f
SHA1

4995743995ef86da91de84600d228f77e91ca718
SHA256

ad3049942127babb8f9423cbe104ef3d78a6cece3e5f7774df401df99ae9962a
SHA512

04ec2bbca13e05ea57fc5087830c6d9e91ef40b029e68fc92fe8d486510ab64f2754e71eb0205e2000bfa0cb0574802166810d03ad1e463bb2055dfe64e221e3
SSDEEP

768:5HnTPZchn9bHROUaJdo9QYqJat/aQukXydQKMNunsn8:5HnTPZqn9yo3qJat/DyBZsn

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1972	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1972	956	rundll32.exe	28
PID 956 wrote to memory of 1972	956	rundll32.exe	28
PID 956 wrote to memory of 1972	956	rundll32.exe	28
PID 956 wrote to memory of 1972	956	rundll32.exe	28
PID 956 wrote to memory of 1972	956	rundll32.exe	28
PID 956 wrote to memory of 1972	956	rundll32.exe	28
PID 956 wrote to memory of 1972	956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad3049942127babb8f9423cbe104ef3d78a6cece3e5f7774df401df99ae9962a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad3049942127babb8f9423cbe104ef3d78a6cece3e5f7774df401df99ae9962a.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972

memory/1972-55-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x0000000000970000-0x0000000000A43000-memory.dmp

Filesize
844KB

Download