946424a417984b600af7ee5fb781536aa86a3c749f36622c5f9d08b5b56d2833

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 13:33

Target

946424a417984b600af7ee5fb781536aa86a3c749f36622c5f9d08b5b56d2833.dll
Size

156KB
MD5

16d4c8b9065c6b9ce3636e3a4faf565d
SHA1

9608f6cc4462b0a8b13ce11dd5755a7670c7ec94
SHA256

946424a417984b600af7ee5fb781536aa86a3c749f36622c5f9d08b5b56d2833
SHA512

c54b6db1781ed874f837d6d4134df91d906ab6545880f90753c1bd3acfbf0b47a2bc5e9e53be2cb8ec795d81b32aee84c4724f1e3f8e64e88923140c25c8aa23
SSDEEP

3072:g2UxPvVKNiNz1a2JRC+Tq/KThYSzmy8esDdNTgAKja:LGvQ4Nx9RHTVTKSzH8eUN8AK

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1284	rundll32Srv.exe

Loads dropped DLL 2 IoCs

pid	Process
1956	rundll32.exe
1956	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1956	2044	rundll32.exe	26
PID 2044 wrote to memory of 1956	2044	rundll32.exe	26
PID 2044 wrote to memory of 1956	2044	rundll32.exe	26
PID 2044 wrote to memory of 1956	2044	rundll32.exe	26
PID 2044 wrote to memory of 1956	2044	rundll32.exe	26
PID 2044 wrote to memory of 1956	2044	rundll32.exe	26
PID 2044 wrote to memory of 1956	2044	rundll32.exe	26
PID 1956 wrote to memory of 1284	1956	rundll32.exe	27
PID 1956 wrote to memory of 1284	1956	rundll32.exe	27
PID 1956 wrote to memory of 1284	1956	rundll32.exe	27
PID 1956 wrote to memory of 1284	1956	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\946424a417984b600af7ee5fb781536aa86a3c749f36622c5f9d08b5b56d2833.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\946424a417984b600af7ee5fb781536aa86a3c749f36622c5f9d08b5b56d2833.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\rundll32Srv.exe
    C:\Windows\SysWOW64\rundll32Srv.exe
    3⤵
    - Executes dropped EXE
    PID:1284

C:\Windows\SysWOW64\rundll32Srv.exe

Filesize
55KB

MD5
a65b6235354e390993aca1f9aabed4cb

SHA1
11cca96d3b33b619b6fb1c7a81952efaed4e7000

SHA256
af8271ca2a5c6a5922231948b59e159198c3d687f84131034c3744079990379c

SHA512
0c522ccae6c32825157aa51395e55b2989a9cef2eb5774abddf00d80de71e12ac06cdf9c042cab47beb04c144ccada43835d5145b6cbdd87c7d0776ed6232b00

Download Submit
\Windows\SysWOW64\rundll32Srv.exe

Filesize
55KB

MD5
a65b6235354e390993aca1f9aabed4cb

SHA1
11cca96d3b33b619b6fb1c7a81952efaed4e7000

SHA256
af8271ca2a5c6a5922231948b59e159198c3d687f84131034c3744079990379c

SHA512
0c522ccae6c32825157aa51395e55b2989a9cef2eb5774abddf00d80de71e12ac06cdf9c042cab47beb04c144ccada43835d5145b6cbdd87c7d0776ed6232b00

Download Submit
\Windows\SysWOW64\rundll32Srv.exe

Filesize
55KB

MD5
a65b6235354e390993aca1f9aabed4cb

SHA1
11cca96d3b33b619b6fb1c7a81952efaed4e7000

SHA256
af8271ca2a5c6a5922231948b59e159198c3d687f84131034c3744079990379c

SHA512
0c522ccae6c32825157aa51395e55b2989a9cef2eb5774abddf00d80de71e12ac06cdf9c042cab47beb04c144ccada43835d5145b6cbdd87c7d0776ed6232b00

Download Submit
memory/1284-59-0x0000000000000000-mapping.dmp

Download
memory/1956-54-0x0000000000000000-mapping.dmp

Download
memory/1956-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1956-57-0x000000006D280000-0x000000006D2A7000-memory.dmp

Filesize
156KB

Download