050437f90a6fe954ae87a84ec86f94c1fdd7c309df5b6b92e62f40281c69ea2b

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04/10/2023, 20:33

Target

050437f90a6fe954ae87a84ec86f94c1fdd7c309df5b6b92e62f40281c69ea2b.dll
Size

51KB
MD5

6bb7266d8872cdd03a9be1f849a4aa16
SHA1

fff6ebe5bb83a5976f79533a1f43865c9668ec3c
SHA256

050437f90a6fe954ae87a84ec86f94c1fdd7c309df5b6b92e62f40281c69ea2b
SHA512

0446952e3395374945947dc77a3dc99bf9da43c8cbd202cc28a58ce3306053f75d2b867cbdf6f86b75df56bb1e11bc8b2082c65a70310f90baf964d9eb377ddc
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+yJYH5:1dWubF3n9S91BF3fboRJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3044	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 3044	2444	rundll32.exe	28
PID 2444 wrote to memory of 3044	2444	rundll32.exe	28
PID 2444 wrote to memory of 3044	2444	rundll32.exe	28
PID 2444 wrote to memory of 3044	2444	rundll32.exe	28
PID 2444 wrote to memory of 3044	2444	rundll32.exe	28
PID 2444 wrote to memory of 3044	2444	rundll32.exe	28
PID 2444 wrote to memory of 3044	2444	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\050437f90a6fe954ae87a84ec86f94c1fdd7c309df5b6b92e62f40281c69ea2b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\050437f90a6fe954ae87a84ec86f94c1fdd7c309df5b6b92e62f40281c69ea2b.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3044