b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff

Analysis

max time kernel
127s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22/09/2023, 05:14

Target

b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff.dll
Size

50KB
MD5

25d3fe49679f55972b58a98044e9d2c9
SHA1

3730b913d733706975df85df9ce65007b6ba1142
SHA256

b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff
SHA512

81034f46a99013c4c54c82d31d84357c4430e7dd039673be62397f47e92cd3b3d1ea428bf2873353f281253b480dd5806d4aa0c23c0c0d1bcc78fd27b3234ba0
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5zJYH:W5ReWjTrW9rNPgYoRJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1992	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1992	2024	rundll32.exe	28
PID 2024 wrote to memory of 1992	2024	rundll32.exe	28
PID 2024 wrote to memory of 1992	2024	rundll32.exe	28
PID 2024 wrote to memory of 1992	2024	rundll32.exe	28
PID 2024 wrote to memory of 1992	2024	rundll32.exe	28
PID 2024 wrote to memory of 1992	2024	rundll32.exe	28
PID 2024 wrote to memory of 1992	2024	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1992