9a9a34194fb83501ec01f622bb4cf84655f8d243e6e4d66743b26d7cf1028377

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/08/2023, 17:19

Target

9a9a34194fb83501ec01f622bb4cf84655f8d243e6e4d66743b26d7cf1028377.dll
Size

10.9MB
MD5

95040a473652bf1e529663a16bc89802
SHA1

d5207f71dad601c9cf27998d5efe17b5ff5c2a07
SHA256

9a9a34194fb83501ec01f622bb4cf84655f8d243e6e4d66743b26d7cf1028377
SHA512

ed02c82058e964f452333f6addd6f06ccb84f7c1168b442aaa6dbbca93133780227b3376ddf72c509b229410abff71d80207cf901f8297a85ea15660f6a7af07
SSDEEP

196608:Uc+BR6ZkeEe4SzDKWkOv8sFHl40pNuJqw/W4C5402EwREZ1y7h4MCbq7ZR7Yn:dkceqzDKWj9FHl4UuJqD546wREZU4Mc9

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2380	rundll32.exe
2380	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2380	2440	rundll32.exe	28
PID 2440 wrote to memory of 2380	2440	rundll32.exe	28
PID 2440 wrote to memory of 2380	2440	rundll32.exe	28
PID 2440 wrote to memory of 2380	2440	rundll32.exe	28
PID 2440 wrote to memory of 2380	2440	rundll32.exe	28
PID 2440 wrote to memory of 2380	2440	rundll32.exe	28
PID 2440 wrote to memory of 2380	2440	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a9a34194fb83501ec01f622bb4cf84655f8d243e6e4d66743b26d7cf1028377.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a9a34194fb83501ec01f622bb4cf84655f8d243e6e4d66743b26d7cf1028377.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2380

memory/2380-53-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2380-56-0x0000000071190000-0x00000000725F1000-memory.dmp

Filesize
20.4MB

Download
memory/2380-55-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2380-58-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2380-61-0x00000000775D0000-0x00000000775D1000-memory.dmp

Filesize
4KB

Download
memory/2380-60-0x0000000071190000-0x00000000725F1000-memory.dmp

Filesize
20.4MB

Download
memory/2380-65-0x00000000775D0000-0x00000000775D1000-memory.dmp

Filesize
4KB

Download
memory/2380-66-0x0000000071190000-0x00000000725F1000-memory.dmp

Filesize
20.4MB

Download