fbb84748b4907c0e487560f01a0e47d394ab28a1063a9739da6b527a14df3d84

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01/09/2023, 02:44

Target

fbb84748b4907c0e487560f01a0e47d394ab28a1063a9739da6b527a14df3d84.dll
Size

51KB
MD5

770ecd62c4335fbe507d33cc26b3e914
SHA1

272354be2d4f3fd004b701559d2a4bcf3be75e68
SHA256

fbb84748b4907c0e487560f01a0e47d394ab28a1063a9739da6b527a14df3d84
SHA512

e2a628dd9271edfd1302f8849843fc32535ff24072a00dc1571540cbb771b7872d9752e1bdfb595c756540ed6aa91bc1429f66a3f898ac0689b97cca5228c4a2
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLyJYH5:1dWubF3n9S91BF3fboeJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2252	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2252	2216	rundll32.exe	28
PID 2216 wrote to memory of 2252	2216	rundll32.exe	28
PID 2216 wrote to memory of 2252	2216	rundll32.exe	28
PID 2216 wrote to memory of 2252	2216	rundll32.exe	28
PID 2216 wrote to memory of 2252	2216	rundll32.exe	28
PID 2216 wrote to memory of 2252	2216	rundll32.exe	28
PID 2216 wrote to memory of 2252	2216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbb84748b4907c0e487560f01a0e47d394ab28a1063a9739da6b527a14df3d84.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbb84748b4907c0e487560f01a0e47d394ab28a1063a9739da6b527a14df3d84.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2252