50f40e140e2851d818d6b5695d3cde6fe522ace365034ffb3bd8937405b18605

Analysis

max time kernel
143s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:38

Target

0c27f976c8b9f2bee75d59ff6bb812a6.dll
Size

79KB
MD5

0c27f976c8b9f2bee75d59ff6bb812a6
SHA1

2642f05a65a082b4b3fd7c0b29184949a99ff9b8
SHA256

50f40e140e2851d818d6b5695d3cde6fe522ace365034ffb3bd8937405b18605
SHA512

daa05e360a9ea408db4b5411ec09742bf873f69fb1199a7cb1c9f9d7f70cff603371f352d9423ba90c21d90743079669c33e2a2814c76187c5edc59867b14880
SSDEEP

1536:wuHoRJlJbT8eox2Icm+cHoI6bUjC8ckM7mRq7lvyU5Bf4pv1/mtTfL:w5J7q2IKY64jtcD7con7f4yhL

Score

1^/10

Suspicious behavior: EnumeratesProcesses 28 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2248	2224	rundll32.exe	28
PID 2224 wrote to memory of 2248	2224	rundll32.exe	28
PID 2224 wrote to memory of 2248	2224	rundll32.exe	28
PID 2224 wrote to memory of 2248	2224	rundll32.exe	28
PID 2224 wrote to memory of 2248	2224	rundll32.exe	28
PID 2224 wrote to memory of 2248	2224	rundll32.exe	28
PID 2224 wrote to memory of 2248	2224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c27f976c8b9f2bee75d59ff6bb812a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c27f976c8b9f2bee75d59ff6bb812a6.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248

memory/2248-1-0x0000000074690000-0x0000000074BB8000-memory.dmp

Filesize
5.2MB

Download
memory/2248-0-0x0000000074160000-0x0000000074688000-memory.dmp

Filesize
5.2MB

Download
memory/2248-3-0x0000000074690000-0x0000000074BB8000-memory.dmp

Filesize
5.2MB

Download
memory/2248-4-0x0000000074160000-0x0000000074688000-memory.dmp

Filesize
5.2MB

Download
memory/2248-5-0x0000000000130000-0x0000000000134000-memory.dmp

Filesize
16KB

Download
memory/2248-6-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download