b9e85bdef54d7cda5c2079467fae2cd5ed9deb26d643075847abb603ee1f90f9

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 08:05

Target

b9e85bdef54d7cda5c2079467fae2cd5ed9deb26d643075847abb603ee1f90f9.dll
Size

51KB
MD5

426ac977f4802128f333b3e1e6e16354
SHA1

782a41ed15819362e1be48db986b89bf096db6dd
SHA256

b9e85bdef54d7cda5c2079467fae2cd5ed9deb26d643075847abb603ee1f90f9
SHA512

695a9f785b78fc92ced69909d80b3646a877af2106731bd27e588001edf01b6f832e21f08a9e6c9311f2e26481c906561c7b10b47aa6c526e1a9f2d45ab947c3
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLKJYH5:1dWubF3n9S91BF3fbo+JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2096	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2096	2936	rundll32.exe	28
PID 2936 wrote to memory of 2096	2936	rundll32.exe	28
PID 2936 wrote to memory of 2096	2936	rundll32.exe	28
PID 2936 wrote to memory of 2096	2936	rundll32.exe	28
PID 2936 wrote to memory of 2096	2936	rundll32.exe	28
PID 2936 wrote to memory of 2096	2936	rundll32.exe	28
PID 2936 wrote to memory of 2096	2936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9e85bdef54d7cda5c2079467fae2cd5ed9deb26d643075847abb603ee1f90f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9e85bdef54d7cda5c2079467fae2cd5ed9deb26d643075847abb603ee1f90f9.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2096