5b9fc59c78a24323e4ad0bdd7624b7a59fd4609a3dc92f8426d7ffdc1ee638fb

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:47

Target

2a78f3c286482b9ef269fe73745784a3.dll
Size

20KB
MD5

2a78f3c286482b9ef269fe73745784a3
SHA1

0fc020aeb08b8885e89f76b1c82decee4777b237
SHA256

5b9fc59c78a24323e4ad0bdd7624b7a59fd4609a3dc92f8426d7ffdc1ee638fb
SHA512

6bcf6a84693c2de5d6b978b3e17d6c4a0d9a74342ad0482bcadb2cc7827f107d44681697c9ad1e4076ce1d5a5ea49f6bae63c4dbec27eabb1dda7eba757d8ba2
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0XplyCAu8UaWHuqaTlX0wG:zfYh2oCtpXPyx2OqaewG

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
880	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 880	2908	rundll32.exe	16
PID 2908 wrote to memory of 880	2908	rundll32.exe	16
PID 2908 wrote to memory of 880	2908	rundll32.exe	16
PID 2908 wrote to memory of 880	2908	rundll32.exe	16
PID 2908 wrote to memory of 880	2908	rundll32.exe	16
PID 2908 wrote to memory of 880	2908	rundll32.exe	16
PID 2908 wrote to memory of 880	2908	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a78f3c286482b9ef269fe73745784a3.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:880

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a78f3c286482b9ef269fe73745784a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908