19bf50819ee2e3b3f6c86c4a64889889c05a1e135348136cfafeba7e03cc0e3b

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 16:53

Target

06bce9faeca418674412ad10d336eeb1.dll
Size

37KB
MD5

06bce9faeca418674412ad10d336eeb1
SHA1

f5bd17327def75a971f518a15dbf72f1d919a343
SHA256

19bf50819ee2e3b3f6c86c4a64889889c05a1e135348136cfafeba7e03cc0e3b
SHA512

74bf2f1ac1aa2c115f0b9b0b18cd7bdfbc07dfceef72f6f9856e30620a28f44aa47491c4b45838bafc7e262be299e8175ad898c5e9700e3bb8add3a8ce2269f5
SSDEEP

768:R2k79wslGXkQqlX1ujD+3bKQg9vzTbnR4aK4Bd90JnWFl1:59wslGXkXXqDmKQWTbneaH70ZWFl1

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2496	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2496	2928	rundll32.exe	16
PID 2928 wrote to memory of 2496	2928	rundll32.exe	16
PID 2928 wrote to memory of 2496	2928	rundll32.exe	16
PID 2928 wrote to memory of 2496	2928	rundll32.exe	16
PID 2928 wrote to memory of 2496	2928	rundll32.exe	16
PID 2928 wrote to memory of 2496	2928	rundll32.exe	16
PID 2928 wrote to memory of 2496	2928	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06bce9faeca418674412ad10d336eeb1.dll,#1
1⤵
- Suspicious behavior: RenamesItself
PID:2496

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06bce9faeca418674412ad10d336eeb1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928