793173bebb75496f592ae2a33e101a8964ec4b59b1fc2b3309e1e5de78803aa0

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
06/11/2023, 03:43

Target

793173bebb75496f592ae2a33e101a8964ec4b59b1fc2b3309e1e5de78803aa0.dll
Size

51KB
MD5

1adc06bc4b51debe27e92b8abeac1261
SHA1

9ddf34ac55990bb897c08521576d8c03fe8e566d
SHA256

793173bebb75496f592ae2a33e101a8964ec4b59b1fc2b3309e1e5de78803aa0
SHA512

eeaeedcbff99e46a82b935f39cdbf7fd759e7b3e6f3c8fa42896faaa9297b0c84a75dbc6058f00e1d93b5f88490d2ac8fbc2f7db39565fa6bfdaf0e00bbc224f
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL4JYH5:1dWubF3n9S91BF3fboUJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1912	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1912	2164	rundll32.exe	28
PID 2164 wrote to memory of 1912	2164	rundll32.exe	28
PID 2164 wrote to memory of 1912	2164	rundll32.exe	28
PID 2164 wrote to memory of 1912	2164	rundll32.exe	28
PID 2164 wrote to memory of 1912	2164	rundll32.exe	28
PID 2164 wrote to memory of 1912	2164	rundll32.exe	28
PID 2164 wrote to memory of 1912	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\793173bebb75496f592ae2a33e101a8964ec4b59b1fc2b3309e1e5de78803aa0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\793173bebb75496f592ae2a33e101a8964ec4b59b1fc2b3309e1e5de78803aa0.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1912