37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
18/09/2023, 06:35

Target

37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa.dll
Size

51KB
MD5

b3bdc23bd385f4a6cc26893e645c6960
SHA1

2e5b86fe120e0d351e5066857b419e387bbebb95
SHA256

37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa
SHA512

78ffa43eb5427384d206435da8be211899e3a47ddc9bf45b53ab01845c0aea164afd927e5753bdb99b35ea768bd56a5008789e7d8cf5efae1dd029b3c8a2ce8f
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLEJYH5:1dWubF3n9S91BF3fbooJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2076	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 2076	388	rundll32.exe	28
PID 388 wrote to memory of 2076	388	rundll32.exe	28
PID 388 wrote to memory of 2076	388	rundll32.exe	28
PID 388 wrote to memory of 2076	388	rundll32.exe	28
PID 388 wrote to memory of 2076	388	rundll32.exe	28
PID 388 wrote to memory of 2076	388	rundll32.exe	28
PID 388 wrote to memory of 2076	388	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2076