b3251f8ff07088d16363f031b4b7ca144f4d6fab13d1e748985b683e81d79e66

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 22:39

Target

b3251f8ff07088d16363f031b4b7ca144f4d6fab13d1e748985b683e81d79e66.dll
Size

51KB
MD5

8c5de3ded9aa64d9b12644cfbba71c8e
SHA1

433951223b6b076bdf00f9e7cd5b9f309ecaff4e
SHA256

b3251f8ff07088d16363f031b4b7ca144f4d6fab13d1e748985b683e81d79e66
SHA512

20d88d500a8f9165f7f2b684455c0348e9b1731becad90354fd0ecd5181d44d67e586be2830a5773f91d7b2c0dc959df6ed567f6f627ae9d6a164a2dce091b6d
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+UJYH5:1dWubF3n9S91BF3fbo7JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2164	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2164	1292	rundll32.exe	22
PID 1292 wrote to memory of 2164	1292	rundll32.exe	22
PID 1292 wrote to memory of 2164	1292	rundll32.exe	22
PID 1292 wrote to memory of 2164	1292	rundll32.exe	22
PID 1292 wrote to memory of 2164	1292	rundll32.exe	22
PID 1292 wrote to memory of 2164	1292	rundll32.exe	22
PID 1292 wrote to memory of 2164	1292	rundll32.exe	22

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3251f8ff07088d16363f031b4b7ca144f4d6fab13d1e748985b683e81d79e66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3251f8ff07088d16363f031b4b7ca144f4d6fab13d1e748985b683e81d79e66.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2164