de0ea8f4a8ffd1c65cb20c6a9d8345b995c05b322801e7834a0dea43833bc081

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 15:01

Target

17fc08bfd797bc70329a821c4dac6d0e69b87f8591c46f2fc47b847ce75661b5.dll
Size

2.3MB
MD5

6e1860f61971b93e96173014633d9d29
SHA1

05b27b88fc994f6f6923e54b671eba9361605cff
SHA256

17fc08bfd797bc70329a821c4dac6d0e69b87f8591c46f2fc47b847ce75661b5
SHA512

cd76b11c6fb4e659ac02dc90f31f2e9cbfb2f0998eec96f2548f4d3844b32dbc9183de1754f2d11eb7eb0f0926e711e051ef70be85df7be66778360c2c92dfdb
SSDEEP

24576:18GaaELLZHS8pPKVK4r2V1NNryCi6scK0oTWdT33ZitmUDmbaLb+LCyS:1CLA8pq2VXVscK0oKdTH4AUKNS

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	2584	rundll32.exe
3	2584	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2584	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2584	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2584	2552	rundll32.exe	28
PID 2552 wrote to memory of 2584	2552	rundll32.exe	28
PID 2552 wrote to memory of 2584	2552	rundll32.exe	28
PID 2552 wrote to memory of 2584	2552	rundll32.exe	28
PID 2552 wrote to memory of 2584	2552	rundll32.exe	28
PID 2552 wrote to memory of 2584	2552	rundll32.exe	28
PID 2552 wrote to memory of 2584	2552	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17fc08bfd797bc70329a821c4dac6d0e69b87f8591c46f2fc47b847ce75661b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17fc08bfd797bc70329a821c4dac6d0e69b87f8591c46f2fc47b847ce75661b5.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2584