506f6257a658823208866d3ac7cf1a1077b3ef6355a39f46db4781e7525873b4

Analysis

max time kernel
150s
max time network
166s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:40

Target

01c416916824b9d4bb9af57ed7753ceb.dll
Size

108KB
MD5

01c416916824b9d4bb9af57ed7753ceb
SHA1

beee45af13be9e05564d318de3fe4d5aeb57a699
SHA256

506f6257a658823208866d3ac7cf1a1077b3ef6355a39f46db4781e7525873b4
SHA512

af7b9e3aeb3149b17b236e05ff2f991ae538fbe42dca6cc09bd1c1a777309307da6561cd709dd2a1aa8e8431cb3182d93c6d0dfc46efdf517e18ec0a6f5a1907
SSDEEP

1536:ZfYUGuXa2lNTj+v6ZTOeLtjvz40MblaWxI1rIwOReXJPI6NTlO0:xYUGu/nJOgxvztyaWirIwyeXJg6NZh

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2148	rundll32.exe
2148	rundll32.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
464	Process not Found
464	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2148	2432	rundll32.exe	28
PID 2432 wrote to memory of 2148	2432	rundll32.exe	28
PID 2432 wrote to memory of 2148	2432	rundll32.exe	28
PID 2432 wrote to memory of 2148	2432	rundll32.exe	28
PID 2432 wrote to memory of 2148	2432	rundll32.exe	28
PID 2432 wrote to memory of 2148	2432	rundll32.exe	28
PID 2432 wrote to memory of 2148	2432	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01c416916824b9d4bb9af57ed7753ceb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01c416916824b9d4bb9af57ed7753ceb.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148