6bafa6b0cf3650ad95a4b4ca41c7898daeef9f5a45cb3df0ce3b55eaadae01b6

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/12/2023, 23:29

Target

6bafa6b0cf3650ad95a4b4ca41c7898daeef9f5a45cb3df0ce3b55eaadae01b6.dll
Size

899KB
MD5

002591ce08fe5a9e8ef2ddae7fc6ac00
SHA1

baf7394c6ff624d1553b6b2bc62c64bc22f99b51
SHA256

6bafa6b0cf3650ad95a4b4ca41c7898daeef9f5a45cb3df0ce3b55eaadae01b6
SHA512

8344d1b45963790505171b002bea7f03d4f16a7c4b74e1acb020561678fe098d289eb7caf540e8109d0d368f6ffaa58f8d03ed8e3899a9c0f93a5d765790f12f
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXD:7wqd87VD

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1444	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 1444	2596	rundll32.exe	28
PID 2596 wrote to memory of 1444	2596	rundll32.exe	28
PID 2596 wrote to memory of 1444	2596	rundll32.exe	28
PID 2596 wrote to memory of 1444	2596	rundll32.exe	28
PID 2596 wrote to memory of 1444	2596	rundll32.exe	28
PID 2596 wrote to memory of 1444	2596	rundll32.exe	28
PID 2596 wrote to memory of 1444	2596	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bafa6b0cf3650ad95a4b4ca41c7898daeef9f5a45cb3df0ce3b55eaadae01b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bafa6b0cf3650ad95a4b4ca41c7898daeef9f5a45cb3df0ce3b55eaadae01b6.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1444