7c0f72bad64237b4b2749840811299838e0062bd1551182ac82cae17a7e555bf

Analysis

max time kernel
114s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 14:51

Target

refox/file/7z.dll
Size

816KB
MD5

cc3fd265f4242d63f804f0775c085780
SHA1

49a147bb837d62d6b24ac7c3a87bf7f8347c4cfe
SHA256

c804038fe508f3733ba5eca8d9cf8af04e7ac069dccdddabb784843daf364f21
SHA512

c226b4771db940f48b582fea7cff656f580f52ac3fe6556221badc57279c22d297bd00a724965f591d63b27e8be77fbf6efd6a9e6703ecaef8d928c9d630230c
SSDEEP

12288:qBFNZRpX2rshULlswacklsJE77SqilxbX8Kdf0OAHDOORdxQvCru/wV+CM:aFbvGshULKqu7VObXb6OAHDOOvruc+CM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3656 wrote to memory of 1648	3656	rundll32.exe	rundll32.exe
PID 3656 wrote to memory of 1648	3656	rundll32.exe	rundll32.exe
PID 3656 wrote to memory of 1648	3656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\refox\file\7z.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\refox\file\7z.dll,#1
  2⤵
  PID:1648