a53bf8f8553e6def62a558077040dc292eda42ddf2e2109d3d9b3729b66ca26c

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 10:05

Target

a53bf8f8553e6def62a558077040dc292eda42ddf2e2109d3d9b3729b66ca26c.dll
Size

24KB
MD5

e0f92655a31bf753ebe88019d2807ac3
SHA1

59aaf69de3320e1b524b635c75e4c4756b1071fe
SHA256

a53bf8f8553e6def62a558077040dc292eda42ddf2e2109d3d9b3729b66ca26c
SHA512

96f43416c14ff40c480a2b28a2243a5d5de30a89d869d70bf840eb84d5bbb5729fd224109eb5f320327d9be438715f73b1ac3db63963c6e02dc79ea488c4d11f
SSDEEP

384:uRCJ8mkOMEPbqqCs3oGTbwdHICTJ5BMBmoqO4KQRE1cZRJVHfr46WHE3yhbEd8c4:PJ5zdDxF3oGTbwpl5BOxQiWvzKBlWx4

Score

4^/10

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\clbcatq.dll154330791	rundll32.exe
File opened for modification	C:\Windows\linkinfo.dll1579736901	rundll32.exe
File created	C:\Windows\linkinfo.dll	rundll32.exe
File created	C:\Windows\twain_86.dll	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2032	2036	rundll32.exe	27
PID 2036 wrote to memory of 2032	2036	rundll32.exe	27
PID 2036 wrote to memory of 2032	2036	rundll32.exe	27
PID 2036 wrote to memory of 2032	2036	rundll32.exe	27
PID 2036 wrote to memory of 2032	2036	rundll32.exe	27
PID 2036 wrote to memory of 2032	2036	rundll32.exe	27
PID 2036 wrote to memory of 2032	2036	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a53bf8f8553e6def62a558077040dc292eda42ddf2e2109d3d9b3729b66ca26c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a53bf8f8553e6def62a558077040dc292eda42ddf2e2109d3d9b3729b66ca26c.dll,#1
  2⤵
  - Drops file in Windows directory
  PID:2032

memory/2032-55-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/2032-56-0x0000000013140000-0x000000001314A000-memory.dmp

Filesize
40KB

Download
memory/2032-57-0x0000000073F61000-0x0000000073F63000-memory.dmp

Filesize
8KB

Download