0f80f5ac0308a303717a62b968274cbb85962aaf883e22470e25d2f0312afaf4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:11

Target

054502ddc53d08fa04889b9e9471b82f.dll
Size

19KB
MD5

054502ddc53d08fa04889b9e9471b82f
SHA1

fc736a47c8c695d36ef6d08b207a6b52d47c9245
SHA256

0f80f5ac0308a303717a62b968274cbb85962aaf883e22470e25d2f0312afaf4
SHA512

50a4d9a610385892324338bec3c214c506b9e4ba8006b9788f7cb0510c26770ab562f8e01a826c2b6d01a105a37f60495dcd14544feb08bf5da5d28f47185ed4
SSDEEP

384:iwTNRJtf59ssO7nQ2q66DPYApY6WYRRhTKG4ywM791K0FwDIcWBIMuVovya:iARJtDsHn/L6Dj7WYRnTKdM79g0FwDNu

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepion.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
484	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2916	2784	rundll32.exe	16
PID 2784 wrote to memory of 2916	2784	rundll32.exe	16
PID 2784 wrote to memory of 2916	2784	rundll32.exe	16
PID 2784 wrote to memory of 2916	2784	rundll32.exe	16
PID 2784 wrote to memory of 2916	2784	rundll32.exe	16
PID 2784 wrote to memory of 2916	2784	rundll32.exe	16
PID 2784 wrote to memory of 2916	2784	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\054502ddc53d08fa04889b9e9471b82f.dll,#1
1⤵
- Drops file in System32 directory
PID:2916

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\054502ddc53d08fa04889b9e9471b82f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784

memory/2916-0-0x0000000025000000-0x0000000025025000-memory.dmp

Filesize
148KB

Download
memory/2916-1-0x0000000025000000-0x0000000025025000-memory.dmp

Filesize
148KB

Download