11cb95a52644a63b678f3cc311faddf0a6c10dbab37decda7625c21ff7cba1f7

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23-09-2023 22:05

Target

11cb95a52644a63b678f3cc311faddf0a6c10dbab37decda7625c21ff7cba1f7.dll
Size

51KB
MD5

9d1f961e7311e28628968d1c531fc910
SHA1

cf88269f56c317427a6b8b28fad929932bf83fd8
SHA256

11cb95a52644a63b678f3cc311faddf0a6c10dbab37decda7625c21ff7cba1f7
SHA512

7bff7efc7c5e5ce8e9d8a9d8be07986358be8839ecca0917a776ed477496ca2972c20a932e89f82433624a3b4b27f12e1b720bd442e65a8178561136fc6239ac
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLrJYH5:1dWubF3n9S91BF3fbo3JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2064	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2064	1724	rundll32.exe	28
PID 1724 wrote to memory of 2064	1724	rundll32.exe	28
PID 1724 wrote to memory of 2064	1724	rundll32.exe	28
PID 1724 wrote to memory of 2064	1724	rundll32.exe	28
PID 1724 wrote to memory of 2064	1724	rundll32.exe	28
PID 1724 wrote to memory of 2064	1724	rundll32.exe	28
PID 1724 wrote to memory of 2064	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11cb95a52644a63b678f3cc311faddf0a6c10dbab37decda7625c21ff7cba1f7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11cb95a52644a63b678f3cc311faddf0a6c10dbab37decda7625c21ff7cba1f7.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2064