e809a8893b6c0cc0eb04fabc67c9e2cbfe7806113cc2e20d279946b0f69398fe

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:28

Target

295dbe9a386d8af87d38d04b6e7cac8b.dll
Size

364KB
MD5

295dbe9a386d8af87d38d04b6e7cac8b
SHA1

1b207e6741994a9527f0ea32c54e1ab4d66070e8
SHA256

e809a8893b6c0cc0eb04fabc67c9e2cbfe7806113cc2e20d279946b0f69398fe
SHA512

e18aed348ffc6c0da0f89e1dc7a5eba097d7e38b78035447522ab8ad905e8432042203348df4fcef8c4b65286af80b66064fd5e164bba1e5a5a0b88c35e5f467
SSDEEP

6144:SnilbOMzkUxD7AHvMQwT96fGqB5EEcZ48JJfYQvokQ38OXTBNNj:SixOsvRpXZrtRAkQ3XBNNj

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1512	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1512	1340	rundll32.exe	28
PID 1340 wrote to memory of 1512	1340	rundll32.exe	28
PID 1340 wrote to memory of 1512	1340	rundll32.exe	28
PID 1340 wrote to memory of 1512	1340	rundll32.exe	28
PID 1340 wrote to memory of 1512	1340	rundll32.exe	28
PID 1340 wrote to memory of 1512	1340	rundll32.exe	28
PID 1340 wrote to memory of 1512	1340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\295dbe9a386d8af87d38d04b6e7cac8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\295dbe9a386d8af87d38d04b6e7cac8b.dll,#1
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1512

memory/1512-1-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download
memory/1512-0-0x00000000007C0000-0x0000000000800000-memory.dmp

Filesize
256KB

Download
memory/1512-2-0x00000000007C0000-0x0000000000800000-memory.dmp

Filesize
256KB

Download