bd7623e8f6571ae78d1495de53755f1f4a5ce1370a5296f6eba629d893740214

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04-09-2023 07:03

Target

Device/HarddiskVolume1/OldUserProfile Alessa Domain/salu/AppData/LocalLow/BrotherSoft_Extreme2_B1/hktbBrot.dll
Size

1.0MB
MD5

44b16fb2d8a860fdea6f4e5eeb7d59e1
SHA1

a473f1057d0844c61ed68047f97c6cd8b3f79f51
SHA256

92cdfd800e4f70b5d1c2c722670f22ee86d634047c4dcf5e3c9294155f8e0fb4
SHA512

d9da9e6f63f03cadaab606b6fffcd0197053ff2e38b66929fa258c75ec803c7a0c6de108baa5165cff6c542d623b513563a6dca64bd4bf23b49ec676949fcf3a
SSDEEP

12288:B4MoW5hyJ0Gs2flY4HEx6YU9SP9qGqFb3d1bM/aWYUOGvWSfqg:4WHyJJfYU9SP9obN1gyWLOpSyg

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1172	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1172	2460	rundll32.exe	28
PID 2460 wrote to memory of 1172	2460	rundll32.exe	28
PID 2460 wrote to memory of 1172	2460	rundll32.exe	28
PID 2460 wrote to memory of 1172	2460	rundll32.exe	28
PID 2460 wrote to memory of 1172	2460	rundll32.exe	28
PID 2460 wrote to memory of 1172	2460	rundll32.exe	28
PID 2460 wrote to memory of 1172	2460	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume1\OldUserProfile Alessa Domain\salu\AppData\LocalLow\BrotherSoft_Extreme2_B1\hktbBrot.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume1\OldUserProfile Alessa Domain\salu\AppData\LocalLow\BrotherSoft_Extreme2_B1\hktbBrot.dll",#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172