b4c869c6acd21d5ff95aa0220740a19c7b972eb6855b6e6c27b67e37375280e4

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 19:51

Target

b4c869c6acd21d5ff95aa0220740a19c7b972eb6855b6e6c27b67e37375280e4.dll
Size

899KB
MD5

cb57106f37f8379567c29bc58812935d
SHA1

a427043fed08228e384c0c0c82f41651c79ee121
SHA256

b4c869c6acd21d5ff95aa0220740a19c7b972eb6855b6e6c27b67e37375280e4
SHA512

4a794a79d0cfdce2ba771506cdfe3290bd1034fd6f6cb5e3b2e15b5420e932ca934f76903bf1a048dd4c3df3b4d5023f0b6f200a21230c7efdededa3a13f45e8
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXP:7wqd87VP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2884	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2884	2880	rundll32.exe	28
PID 2880 wrote to memory of 2884	2880	rundll32.exe	28
PID 2880 wrote to memory of 2884	2880	rundll32.exe	28
PID 2880 wrote to memory of 2884	2880	rundll32.exe	28
PID 2880 wrote to memory of 2884	2880	rundll32.exe	28
PID 2880 wrote to memory of 2884	2880	rundll32.exe	28
PID 2880 wrote to memory of 2884	2880	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4c869c6acd21d5ff95aa0220740a19c7b972eb6855b6e6c27b67e37375280e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4c869c6acd21d5ff95aa0220740a19c7b972eb6855b6e6c27b67e37375280e4.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2884