950f4c09077d199b9994db08c7c686400cb0620e3bda1b18a304c80571762d6b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:52

Target

20ae67655b21a64d0fc7bca829b6ceb6.dll
Size

24KB
MD5

20ae67655b21a64d0fc7bca829b6ceb6
SHA1

c38cede05f58bba25445755cf574f863d1656a44
SHA256

950f4c09077d199b9994db08c7c686400cb0620e3bda1b18a304c80571762d6b
SHA512

17b84ab199e567b9951f42b43e00ab7213b111cc5b90e0edc9f12ae4ba3a5459be3f567f26047dd9f5b90be4117999475e57be15c097b2654ac0b0294af93f9b
SSDEEP

384:YeO3gGFFGFQH6XSOP27jQDuUQ/Y9GVU0lsmQD4a/4wWmCJRL2tAY:YeWgIGiaXSD7jQDuUuVU0umQ0wlCa+Y

Score

1^/10

Suspicious behavior: EnumeratesProcesses 11 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1748	2500	rundll32.exe	28
PID 2500 wrote to memory of 1748	2500	rundll32.exe	28
PID 2500 wrote to memory of 1748	2500	rundll32.exe	28
PID 2500 wrote to memory of 1748	2500	rundll32.exe	28
PID 2500 wrote to memory of 1748	2500	rundll32.exe	28
PID 2500 wrote to memory of 1748	2500	rundll32.exe	28
PID 2500 wrote to memory of 1748	2500	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\20ae67655b21a64d0fc7bca829b6ceb6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\20ae67655b21a64d0fc7bca829b6ceb6.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748

memory/1748-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download