b9c29bbe638aaff229535702101666df0417d4715f5c3253e2e3c0b2fc6351de

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 20:45

Target

b9c29bbe638aaff229535702101666df0417d4715f5c3253e2e3c0b2fc6351de.dll
Size

51KB
MD5

90016323ee474179def6160e1878244e
SHA1

3a7adb46f41cd3f63309fbaa9ba1740ee3d95671
SHA256

b9c29bbe638aaff229535702101666df0417d4715f5c3253e2e3c0b2fc6351de
SHA512

35099f9c07adb12dfafaa502fe43e3d91d21d3d2b44d5f05dae0b8590850093c903667c761f8a931e6045c973d1a18d0b31fd4ced59b4fdd45db9a70f2033236
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLoJYH5:1dWubF3n9S91BF3fboEJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2196	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2196	1980	rundll32.exe	28
PID 1980 wrote to memory of 2196	1980	rundll32.exe	28
PID 1980 wrote to memory of 2196	1980	rundll32.exe	28
PID 1980 wrote to memory of 2196	1980	rundll32.exe	28
PID 1980 wrote to memory of 2196	1980	rundll32.exe	28
PID 1980 wrote to memory of 2196	1980	rundll32.exe	28
PID 1980 wrote to memory of 2196	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9c29bbe638aaff229535702101666df0417d4715f5c3253e2e3c0b2fc6351de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9c29bbe638aaff229535702101666df0417d4715f5c3253e2e3c0b2fc6351de.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2196