375fd5dcc724bbaff1793d8aea545affca8a82a41ae0897df6e46149a5cd1942

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
25/11/2023, 09:40

Target

375fd5dcc724bbaff1793d8aea545affca8a82a41ae0897df6e46149a5cd1942.dll
Size

899KB
MD5

81a4df9fed6b482edb6432c7f250811b
SHA1

7bec42fe7f680b92549d44eeccb05b5cafdb4670
SHA256

375fd5dcc724bbaff1793d8aea545affca8a82a41ae0897df6e46149a5cd1942
SHA512

198e9946e36cdf48ed386405b7dc83c5aea7971e829ccdd73a36d2ff1663bcf50e99feabdd58f57208353674472e8fb02296e5cb3b5115d91946e0174de9406a
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXR:7wqd87VR

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1984	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1984	1728	rundll32.exe	28
PID 1728 wrote to memory of 1984	1728	rundll32.exe	28
PID 1728 wrote to memory of 1984	1728	rundll32.exe	28
PID 1728 wrote to memory of 1984	1728	rundll32.exe	28
PID 1728 wrote to memory of 1984	1728	rundll32.exe	28
PID 1728 wrote to memory of 1984	1728	rundll32.exe	28
PID 1728 wrote to memory of 1984	1728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\375fd5dcc724bbaff1793d8aea545affca8a82a41ae0897df6e46149a5cd1942.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\375fd5dcc724bbaff1793d8aea545affca8a82a41ae0897df6e46149a5cd1942.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1984