9ace5a83092a3c42f6e35fac7df92c3da9a50ce6d0b95cd4db238fceeff20fce

Analysis

max time kernel
92s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 14:23

Target

7562b730f1ec8d18b9c5cc8a6263bdfb.dll
Size

20KB
MD5

7562b730f1ec8d18b9c5cc8a6263bdfb
SHA1

934b9f9fc2f8ce85adc9105069b70ef04198de31
SHA256

9ace5a83092a3c42f6e35fac7df92c3da9a50ce6d0b95cd4db238fceeff20fce
SHA512

91688df4757232953d8a20b6edc847fb16ff44c8575a1d2e144c104451414a6a7e757fac26529ea66949f7346b285bbec77288828142de670243778476739987
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0XplpCAu8UaWHuqaTlX0wG:zfYh2oCtpXPpx2OqaewG

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
2840	rundll32.exe
2840	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 2840	4576	rundll32.exe	86
PID 4576 wrote to memory of 2840	4576	rundll32.exe	86
PID 4576 wrote to memory of 2840	4576	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7562b730f1ec8d18b9c5cc8a6263bdfb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7562b730f1ec8d18b9c5cc8a6263bdfb.dll,#1
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2840

C:\Users\Admin\AppData\Local\Temp\493E.tmp

Filesize
20KB

MD5
886be8b74febf723503364a5fdeed4f9

SHA1
4583ef65cfe2e6360c4eec352770bd50daaee669

SHA256
81a25ccd61a211f9f16281927ea40b8eb95944a0118c813fd01aa21532e48ee9

SHA512
33952f54bb52a7387e86c6c961099f7c1a89690887b9a0dd961e15fca1bf5be09fab7088cd9cfa5f5d01b4002f413ca76d360d9ac409d1e0c9b16c32d7055429

Download Submit
memory/2840-8-0x00000000008D0000-0x00000000008DC000-memory.dmp

Filesize
48KB

Download