84e988d939f420700d8b1a948ef32abcdbb1bf99e726583d61cb9230110a764f

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13/02/2023, 08:46

Target

84e988d939f420700d8b1a948ef32abcdbb1bf99e726583d61cb9230110a764f.dll
Size

97KB
MD5

fa5f2aaec665d7fa94eb74978ab6460f
SHA1

b5995ee998e459583342424d3dc36ca516d6d203
SHA256

84e988d939f420700d8b1a948ef32abcdbb1bf99e726583d61cb9230110a764f
SHA512

8d4163470fad6bfa9d74e040b8fa1f0c563282e2d0a37e11b688f925d6542cb840270f1b1fdd1f2087e8951fd2e971e7caa5727b9200c759c2a20ce52a30273d
SSDEEP

3072:RAUezDZb+otCBhmt+cSfxaTYckPxiT3w:SUED

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
952	rundll32.exe
952	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 952	1728	rundll32.exe	28
PID 1728 wrote to memory of 952	1728	rundll32.exe	28
PID 1728 wrote to memory of 952	1728	rundll32.exe	28
PID 1728 wrote to memory of 952	1728	rundll32.exe	28
PID 1728 wrote to memory of 952	1728	rundll32.exe	28
PID 1728 wrote to memory of 952	1728	rundll32.exe	28
PID 1728 wrote to memory of 952	1728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84e988d939f420700d8b1a948ef32abcdbb1bf99e726583d61cb9230110a764f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\84e988d939f420700d8b1a948ef32abcdbb1bf99e726583d61cb9230110a764f.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:952

memory/952-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/952-56-0x0000000074710000-0x000000007473F000-memory.dmp

Filesize
188KB

Download
memory/952-57-0x0000000074710000-0x000000007473F000-memory.dmp

Filesize
188KB

Download
memory/952-58-0x0000000074740000-0x0000000074753000-memory.dmp

Filesize
76KB

Download