01efd910513c6f53ae4c5090fac62f27081ef51a38bf3934987b2c4d874c5756

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 23:46

Target

01efd910513c6f53ae4c5090fac62f27081ef51a38bf3934987b2c4d874c5756.dll
Size

899KB
MD5

7c3e658a142928fc1703cc70ce88b2be
SHA1

9d6e0693a23fb8de3d76eedc582fbb281a0ae4cd
SHA256

01efd910513c6f53ae4c5090fac62f27081ef51a38bf3934987b2c4d874c5756
SHA512

2e3fec5283408da53c4179c929ec9990a8133a755f5cd073cc31c00233ac3643f11e9e723aeb38bdafa541ed00b1b81474186f7a158875fa7dcef2f0a3de5fc3
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXf:7wqd87Vf

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2668	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2668	2360	rundll32.exe	18
PID 2360 wrote to memory of 2668	2360	rundll32.exe	18
PID 2360 wrote to memory of 2668	2360	rundll32.exe	18
PID 2360 wrote to memory of 2668	2360	rundll32.exe	18
PID 2360 wrote to memory of 2668	2360	rundll32.exe	18
PID 2360 wrote to memory of 2668	2360	rundll32.exe	18
PID 2360 wrote to memory of 2668	2360	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01efd910513c6f53ae4c5090fac62f27081ef51a38bf3934987b2c4d874c5756.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01efd910513c6f53ae4c5090fac62f27081ef51a38bf3934987b2c4d874c5756.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2668