3a90a5bebd804567c55ff9dda30e2c67bab5cc48fa5a6378a9452e541e799886

Analysis

max time kernel
173s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 03:36

Target

3a90a5bebd804567c55ff9dda30e2c67bab5cc48fa5a6378a9452e541e799886.dll
Size

2.7MB
MD5

21ee7927b4616d06dfe4ef516e7217ad
SHA1

7d85b90a6eb9038abf3f35c15094ec96066180b6
SHA256

3a90a5bebd804567c55ff9dda30e2c67bab5cc48fa5a6378a9452e541e799886
SHA512

27a78c4eb52ebbf8f61729d9fd670350b31d0c4ed3091d45a822197a5c391b09a73433513e148357a32abccae161f0a0da61a847a15b6710613fef89ff029277
SSDEEP

49152:0cog6WA4PU+eUlGi2SPWd1ua1eL7ajSjhTSGIo8Y708vp7fTMh9B/aQVF:0cog1JvBPWd1D47am28vNQVao

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3628	E55F.tmp

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.sfx	E55F.tmp
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	E55F.tmp
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll	E55F.tmp
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll	E55F.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	E55F.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
372	rundll32.exe
372	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 372	1296	rundll32.exe	85
PID 1296 wrote to memory of 372	1296	rundll32.exe	85
PID 1296 wrote to memory of 372	1296	rundll32.exe	85
PID 372 wrote to memory of 3628	372	rundll32.exe	87
PID 372 wrote to memory of 3628	372	rundll32.exe	87
PID 372 wrote to memory of 3628	372	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a90a5bebd804567c55ff9dda30e2c67bab5cc48fa5a6378a9452e541e799886.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a90a5bebd804567c55ff9dda30e2c67bab5cc48fa5a6378a9452e541e799886.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Users\Admin\AppData\Local\Temp\E55F.tmp
    C:\Users\Admin\AppData\Local\Temp\E55F.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:3628

C:\Users\Admin\AppData\Local\Temp\E55F.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Local\Temp\E55F.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/372-0-0x00000000027F0000-0x00000000028BB000-memory.dmp

Filesize
812KB

Download
memory/372-1-0x00000000027F0000-0x00000000028BB000-memory.dmp

Filesize
812KB

Download
memory/372-5-0x0000000018000000-0x00000000182AE000-memory.dmp

Filesize
2.7MB

Download
memory/372-12-0x0000000018000000-0x00000000182AE000-memory.dmp

Filesize
2.7MB

Download