4e62e16a2809fe5cd45d5d5f97a80088825119ec77f39e92c18c826892df282a

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/03/2023, 22:07

Target

4e62e16a2809fe5cd45d5d5f97a80088825119ec77f39e92c18c826892df282a.dll
Size

2.4MB
MD5

b8aca45c75b69fa4dd2c591ec09402a9
SHA1

5408f0dd6210c09ed1a97a92db16869d1ae0473e
SHA256

4e62e16a2809fe5cd45d5d5f97a80088825119ec77f39e92c18c826892df282a
SHA512

cface80db8bc0d93b79b2ae01c540eeeb3ce21efe45abcd1fed9e7561b58b0b47cf59828e747ceb35116e8abf75210e36c49a534b16ea27504f7efac0330503e
SSDEEP

49152:llgpgzE7lZn07+0m/tOVJYKRJOP27Nr9rmiURhpHnqykN/VYz:llgpUE7rneRatWJYUf7NrnURnnqy

Score

4^/10

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\SmartWBInput\SmartCloudWB.ini	rundll32.exe
File opened for modification	C:\Program Files (x86)\SmartWBInput\1.6.1.11106\SmartCloudWBInfo.ini	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1104	1396	rundll32.exe	28
PID 1396 wrote to memory of 1104	1396	rundll32.exe	28
PID 1396 wrote to memory of 1104	1396	rundll32.exe	28
PID 1396 wrote to memory of 1104	1396	rundll32.exe	28
PID 1396 wrote to memory of 1104	1396	rundll32.exe	28
PID 1396 wrote to memory of 1104	1396	rundll32.exe	28
PID 1396 wrote to memory of 1104	1396	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e62e16a2809fe5cd45d5d5f97a80088825119ec77f39e92c18c826892df282a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e62e16a2809fe5cd45d5d5f97a80088825119ec77f39e92c18c826892df282a.dll,#1
  2⤵
  - Drops file in Program Files directory
  PID:1104