fa091f7ddda6d2e5f3a33b6428b101c2dd3462f5fafd017374903a27416fd2da

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/09/2023, 23:33

Target

fa091f7ddda6d2e5f3a33b6428b101c2dd3462f5fafd017374903a27416fd2da.dll
Size

51KB
MD5

440ce24db2465a9eae357bedba916941
SHA1

1c49b2ccd9ed86ad7c387f120b0202bbcd7ee8c8
SHA256

fa091f7ddda6d2e5f3a33b6428b101c2dd3462f5fafd017374903a27416fd2da
SHA512

368a478ca9d9ac790079c5c88b7f491fc4baaabf92a432152dac7ecd9e48b44cc8aa9e5f8f2927af6cdc9c5fc7115b328cb4d6b834610c8d2917daf69f8d1714
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL6JYH5:1dWubF3n9S91BF3fboOJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1940	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1940	2204	rundll32.exe	28
PID 2204 wrote to memory of 1940	2204	rundll32.exe	28
PID 2204 wrote to memory of 1940	2204	rundll32.exe	28
PID 2204 wrote to memory of 1940	2204	rundll32.exe	28
PID 2204 wrote to memory of 1940	2204	rundll32.exe	28
PID 2204 wrote to memory of 1940	2204	rundll32.exe	28
PID 2204 wrote to memory of 1940	2204	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa091f7ddda6d2e5f3a33b6428b101c2dd3462f5fafd017374903a27416fd2da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa091f7ddda6d2e5f3a33b6428b101c2dd3462f5fafd017374903a27416fd2da.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1940