d6622cd29917ff7bc000570627ae2249871991374dcb31547fd8ed66619f7809

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
04/07/2023, 13:54

Target

d6622cd29917ff7bc00057062.dll
Size

708KB
MD5

c342148a7cdb82421ffbf9a03463b60f
SHA1

2dfdb9e80dd20e915c33141f121e59e7f9b72207
SHA256

d6622cd29917ff7bc000570627ae2249871991374dcb31547fd8ed66619f7809
SHA512

dc9f5f92ff89062c798eac9601f3d02c726a2c232846d1dce91f10b0abc0c54f3539e3dda5c7b9b57bcedd35bc3d8c7e38b7f101ffdf328edb8c553b0baa37d1
SSDEEP

12288:iemwWlnXHTZac40hZZcJBfsPdKedHllhlLAMM4M6TgUF:iemwWlnXHK0dc7fsPbFNcRt8

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2408	rundll32.exe
2408	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2408	2380	rundll32.exe	29
PID 2380 wrote to memory of 2408	2380	rundll32.exe	29
PID 2380 wrote to memory of 2408	2380	rundll32.exe	29
PID 2380 wrote to memory of 2408	2380	rundll32.exe	29
PID 2380 wrote to memory of 2408	2380	rundll32.exe	29
PID 2380 wrote to memory of 2408	2380	rundll32.exe	29
PID 2380 wrote to memory of 2408	2380	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6622cd29917ff7bc00057062.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6622cd29917ff7bc00057062.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408