777b944f5cec6c945c05371e1693683a8025c04e1f551437fd8336a01ca5a74c

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22/09/2023, 04:57

Target

777b944f5cec6c945c05371e1693683a8025c04e1f551437fd8336a01ca5a74c.dll
Size

51KB
MD5

9791131414b7efac4cdbbabfdd86554d
SHA1

5988be34d606ed896667df11f92803b2a2d106a8
SHA256

777b944f5cec6c945c05371e1693683a8025c04e1f551437fd8336a01ca5a74c
SHA512

4396ad689b1658d655e485c287fb95e98ebce3e470dad8d8525a211d235a66666a1c92b6ea5afb595490c9d2d9a113c7fb7bc765b4d02d6c0c5bb44bc2d25aae
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLQJYH5:1dWubF3n9S91BF3fboEJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2600	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2600	2180	rundll32.exe	28
PID 2180 wrote to memory of 2600	2180	rundll32.exe	28
PID 2180 wrote to memory of 2600	2180	rundll32.exe	28
PID 2180 wrote to memory of 2600	2180	rundll32.exe	28
PID 2180 wrote to memory of 2600	2180	rundll32.exe	28
PID 2180 wrote to memory of 2600	2180	rundll32.exe	28
PID 2180 wrote to memory of 2600	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\777b944f5cec6c945c05371e1693683a8025c04e1f551437fd8336a01ca5a74c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\777b944f5cec6c945c05371e1693683a8025c04e1f551437fd8336a01ca5a74c.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2600