bad52e938f513860dc8abfeb4c4c84bff8e67f1ba3d5b4e55645fd80304f483f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 12:46

Target

8d2fa2ca7e74fdc62e0d5d13f319c0a6.dll
Size

236KB
MD5

8d2fa2ca7e74fdc62e0d5d13f319c0a6
SHA1

1a29ffd879dbac69cae40266cbd528cac9c9c409
SHA256

bad52e938f513860dc8abfeb4c4c84bff8e67f1ba3d5b4e55645fd80304f483f
SHA512

76cb1e2b1734ded5649fa9d46c4f187599edfd1dd06af3cd5b9b0976cf55df1ed16ae3fe0773d7223ef3aa7611bc4b3cfdb8908e77ef6ea8482790e0340aa36a
SSDEEP

3072:LDLGE+kzjsJWhDVi43sktotKkBlQQ2G/bxsyz+p/TyL9ylo1HuYOoeJZiV8vLTBL:COsJYU+s/Qktz+p/mAldnoeK8vLTBL

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SCBYDL\	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 2128	1040	rundll32.exe	13
PID 1040 wrote to memory of 2128	1040	rundll32.exe	13
PID 1040 wrote to memory of 2128	1040	rundll32.exe	13
PID 1040 wrote to memory of 2128	1040	rundll32.exe	13
PID 1040 wrote to memory of 2128	1040	rundll32.exe	13
PID 1040 wrote to memory of 2128	1040	rundll32.exe	13
PID 1040 wrote to memory of 2128	1040	rundll32.exe	13

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d2fa2ca7e74fdc62e0d5d13f319c0a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d2fa2ca7e74fdc62e0d5d13f319c0a6.dll,#1
  2⤵
  - Drops file in Windows directory
  PID:2128