dcc4455e2ec871a4d98711003d09a1e2103dd91abdfe8066efee2e3de0745eb4

Analysis

max time kernel
188s
max time network
225s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 19:57

Target

dcc4455e2ec871a4d98711003d09a1e2103dd91abdfe8066efee2e3de0745eb4.dll
Size

2.6MB
MD5

f78c76a6dea113111688ddac43bd4036
SHA1

a0dfd8afa3bf2d72e9fff5f587797fe9c045c9aa
SHA256

dcc4455e2ec871a4d98711003d09a1e2103dd91abdfe8066efee2e3de0745eb4
SHA512

9c5fb02da3ae0be779e2615e0e7420f819564e0fd08f067f872dd59f46b19936e532bcd73bd1b69a2225f7986253262e7d04c1b508119a1166999c2089890ebd
SSDEEP

49152:KubU4QRlRKXVsUCDpPJU8NE8A35pXhEQTZ1lsc47vsUmPot1hkchTV2ztvZ/F6:boTKXGVpPJnZAzeNmw1hk8Tcx

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4564	9D35.tmp

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.sfx	9D35.tmp
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	9D35.tmp
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll	9D35.tmp
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll	9D35.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4628	rundll32.exe
4628	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 4628	3548	rundll32.exe	81
PID 3548 wrote to memory of 4628	3548	rundll32.exe	81
PID 3548 wrote to memory of 4628	3548	rundll32.exe	81
PID 4628 wrote to memory of 4564	4628	rundll32.exe	83
PID 4628 wrote to memory of 4564	4628	rundll32.exe	83
PID 4628 wrote to memory of 4564	4628	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dcc4455e2ec871a4d98711003d09a1e2103dd91abdfe8066efee2e3de0745eb4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dcc4455e2ec871a4d98711003d09a1e2103dd91abdfe8066efee2e3de0745eb4.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Users\Admin\AppData\Local\Temp\9D35.tmp
    C:\Users\Admin\AppData\Local\Temp\9D35.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4564

C:\Users\Admin\AppData\Local\Temp\9D35.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Local\Temp\9D35.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/4628-0-0x0000000002A70000-0x0000000002B38000-memory.dmp

Filesize
800KB

Download
memory/4628-1-0x0000000002A70000-0x0000000002B38000-memory.dmp

Filesize
800KB

Download