5aafefe7aac7e28222839d18051a9c975960097b8af997bf517cb8d136468d37

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 13:52

Target

5aafefe7aac7e28222839d18051a9c975960097b8af997bf517cb8d136468d37.dll
Size

51KB
MD5

c2ec98884bb99efbe31da83c4ff883ab
SHA1

fd9a65dc52267f81c32d2ccf8efb33265096bc42
SHA256

5aafefe7aac7e28222839d18051a9c975960097b8af997bf517cb8d136468d37
SHA512

bda12f9b06404c38e2e263b43eef9f0adee2248fc6fd0bb12bf29280671237942bbaf79aab7f35f9784fd40904ba783802834fceab44027ce30f077e95f145f5
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLhJYH5:1dWubF3n9S91BF3fbo9JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2036	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2036	2200	rundll32.exe	29
PID 2200 wrote to memory of 2036	2200	rundll32.exe	29
PID 2200 wrote to memory of 2036	2200	rundll32.exe	29
PID 2200 wrote to memory of 2036	2200	rundll32.exe	29
PID 2200 wrote to memory of 2036	2200	rundll32.exe	29
PID 2200 wrote to memory of 2036	2200	rundll32.exe	29
PID 2200 wrote to memory of 2036	2200	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aafefe7aac7e28222839d18051a9c975960097b8af997bf517cb8d136468d37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aafefe7aac7e28222839d18051a9c975960097b8af997bf517cb8d136468d37.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2036