f784c74492c1edc0d33ab04c2d921642348f1584f5e982f17f799d7a2193b420

Analysis

max time kernel
145s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:33

Target

0092a141e81e076a34d1432f81ab18ec.dll
Size

521KB
MD5

0092a141e81e076a34d1432f81ab18ec
SHA1

ca63bddf2edbb029297c2ac548b54a7109246f0e
SHA256

f784c74492c1edc0d33ab04c2d921642348f1584f5e982f17f799d7a2193b420
SHA512

459e3e3290fa5a87906a9c8c58f5f606afbd2b5ad2c9c1767f29d2d9059ecde34b91ae40f15f6f901fa559a13daafda48d42d4525aa7aace72da005b66c63209
SSDEEP

384:dOr5NKZ21y4hW5N2fM0WngJZ568MEL6BcEtePDXuzdxJqYYvST/:kr5T8N2fMD+f68M8LudxSq

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2264	2936	rundll32.exe	28
PID 2936 wrote to memory of 2264	2936	rundll32.exe	28
PID 2936 wrote to memory of 2264	2936	rundll32.exe	28
PID 2936 wrote to memory of 2264	2936	rundll32.exe	28
PID 2936 wrote to memory of 2264	2936	rundll32.exe	28
PID 2936 wrote to memory of 2264	2936	rundll32.exe	28
PID 2936 wrote to memory of 2264	2936	rundll32.exe	28
PID 2264 wrote to memory of 2156	2264	rundll32.exe	29
PID 2264 wrote to memory of 2156	2264	rundll32.exe	29
PID 2264 wrote to memory of 2156	2264	rundll32.exe	29
PID 2264 wrote to memory of 2156	2264	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0092a141e81e076a34d1432f81ab18ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0092a141e81e076a34d1432f81ab18ec.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259397542.bat
    3⤵
    PID:2156

C:\Users\Admin\AppData\Local\Temp\~DFD259397542.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit