48db9c7a58bd1e147616db1f3264f9be66b5889c1f84a050bf02133f54433209

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 20:59

Target

f7d392ed6a6254e1e243ad90e503d7ea.dll
Size

89KB
MD5

f7d392ed6a6254e1e243ad90e503d7ea
SHA1

27eb4593d04bd2359807e44c914adff921d5a112
SHA256

48db9c7a58bd1e147616db1f3264f9be66b5889c1f84a050bf02133f54433209
SHA512

5d8aad6761f9d5463804a049a4f6227ac1409e64f3020385b9fbe16d15544af2f0420f88e8effa83608e1dc58a912fc55e643b56835192f9458f5de3db0e40e8
SSDEEP

1536:KYD/szd1ptO2+sD0d2n8isKC1+zNoCkoCHOT9HJB0eAiV:tzszdM2hDo2n5sKC16oCkoCHOBHJBv

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1928	1768	rundll32.exe	18
PID 1768 wrote to memory of 1928	1768	rundll32.exe	18
PID 1768 wrote to memory of 1928	1768	rundll32.exe	18
PID 1768 wrote to memory of 1928	1768	rundll32.exe	18
PID 1768 wrote to memory of 1928	1768	rundll32.exe	18
PID 1768 wrote to memory of 1928	1768	rundll32.exe	18
PID 1768 wrote to memory of 1928	1768	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7d392ed6a6254e1e243ad90e503d7ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7d392ed6a6254e1e243ad90e503d7ea.dll,#1
  2⤵
  PID:1928