221bf5b926b760ee758a3f7bbf9ebfbe5c9224f46b13f86d10e332d97e387ffb

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 03:46

Target

221bf5b926b760ee758a3f7bbf9ebfbe5c9224f46b13f86d10e332d97e387ffb.dll
Size

51KB
MD5

14747330907ce09eb75702a5fbded523
SHA1

6724a9f893b60220ab1d37a422cdeea2760496d2
SHA256

221bf5b926b760ee758a3f7bbf9ebfbe5c9224f46b13f86d10e332d97e387ffb
SHA512

7d3b3abca9268bae6cbbdf55be9ef6390f65e2afcbf60f44c914077ec6c16796c650610081bc9c50402e30c4f138027515366ba437bc0ddae107b0504e5aa397
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+IJYH5:1dWubF3n9S91BF3fbo/JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2200	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2200	2600	rundll32.exe	28
PID 2600 wrote to memory of 2200	2600	rundll32.exe	28
PID 2600 wrote to memory of 2200	2600	rundll32.exe	28
PID 2600 wrote to memory of 2200	2600	rundll32.exe	28
PID 2600 wrote to memory of 2200	2600	rundll32.exe	28
PID 2600 wrote to memory of 2200	2600	rundll32.exe	28
PID 2600 wrote to memory of 2200	2600	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\221bf5b926b760ee758a3f7bbf9ebfbe5c9224f46b13f86d10e332d97e387ffb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\221bf5b926b760ee758a3f7bbf9ebfbe5c9224f46b13f86d10e332d97e387ffb.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2200