dd4ba8abe88f4a2a3f9eccc64f0e22fc77b341c750604618cccd93c8c9cbba28

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:31

Target

0115ca9901e35dd33226f76587175f9a.dll
Size

173KB
MD5

0115ca9901e35dd33226f76587175f9a
SHA1

674da62b274681e8d71a7b70994d8fef993643a4
SHA256

dd4ba8abe88f4a2a3f9eccc64f0e22fc77b341c750604618cccd93c8c9cbba28
SHA512

69ec23e843f43ceb13e8210a4cf0121791ccebce466d79b68b432f41bc7d54c0e518ca3584cc149151d2cbc1b710b454a6b2642cbb0d0f58b76628736a82407e
SSDEEP

3072:7OT05oZPGSw632OjXIqR/GgMoaHFTw0CSkTTqQ4jU7JM3D743N1:iTeRSzVDNkk0vkfqQet6N1

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ernel32.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ernel32.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2652	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2652	2748	rundll32.exe	16
PID 2748 wrote to memory of 2652	2748	rundll32.exe	16
PID 2748 wrote to memory of 2652	2748	rundll32.exe	16
PID 2748 wrote to memory of 2652	2748	rundll32.exe	16
PID 2748 wrote to memory of 2652	2748	rundll32.exe	16
PID 2748 wrote to memory of 2652	2748	rundll32.exe	16
PID 2748 wrote to memory of 2652	2748	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0115ca9901e35dd33226f76587175f9a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748

memory/2652-0-0x00000000001F0000-0x00000000001FD000-memory.dmp

Filesize
52KB

Download
memory/2652-1-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2652-4-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download