d4c4593a808e01615e57dc77df671953fbee9bc072f85dadf4ffae9e2daa9ef8

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 01:14

Target

d4c4593a808e01615e57dc77df671953fbee9bc072f85dadf4ffae9e2daa9ef8.dll
Size

67KB
MD5

d0cb98ee79a509868a670d5ab81cbe30
SHA1

bb963a3f6c956c7874e8dd0837500ee7aaa11af8
SHA256

d4c4593a808e01615e57dc77df671953fbee9bc072f85dadf4ffae9e2daa9ef8
SHA512

37239198f618d602f4d3468afd39c39c7ff5a5c8f1a156afb19e0e1373eac23f4f1a0cc5c6f5f59897b6e7f061e42360129776ccb56bf3a4ad8fe7ca678a81cc
SSDEEP

768:td3p2uFBmzBlYVGnFNroEjBLuoZWukGyYSM+b32ifUvLUAW9cn6otH:td3p/FBgBoGnMEdSoZWGC32ifWX6ot

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2004	rundll32.exe
2004	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4c4593a808e01615e57dc77df671953fbee9bc072f85dadf4ffae9e2daa9ef8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4c4593a808e01615e57dc77df671953fbee9bc072f85dadf4ffae9e2daa9ef8.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2004

memory/2004-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download