eda17da40ce607b97634523e8d2a010a5d9f6c896e4d8a2fb53c73dbafd87ea8

Analysis

max time kernel
167s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 10:42

Target

1640807da42d8d05733ba76c9dab8ce7.dll
Size

72KB
MD5

1640807da42d8d05733ba76c9dab8ce7
SHA1

5cdc7aa1aebfd435b071a81da9bfd50c8b6024fa
SHA256

eda17da40ce607b97634523e8d2a010a5d9f6c896e4d8a2fb53c73dbafd87ea8
SHA512

30c6d0db8a5f4e63bf4365aee8fe2ff0562b4a77b9a277fc151a9be04a88a14ec2866ac8451b80aa4c79432ea27df2afe9e9d6448258c60cebe05f93392e02a4
SSDEEP

1536:FcY/G/AS63g1ElEd9FeaK97dgxuddoCP5hyoHEwcXLone:FcY/GnbP9cd7dgqme5hyoHEMe

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mseion.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3232	2248	rundll32.exe	87
PID 2248 wrote to memory of 3232	2248	rundll32.exe	87
PID 2248 wrote to memory of 3232	2248	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1640807da42d8d05733ba76c9dab8ce7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1640807da42d8d05733ba76c9dab8ce7.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:3232

memory/3232-0-0x0000000025000000-0x0000000025064000-memory.dmp

Filesize
400KB

Download