f692935cf773826e02ded659397761a2dcac760ded63c10f7ceb2ec55b6e986a

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 13:55

Target

1ab607240973a2b7e034cb420f09e2bf.dll
Size

19KB
MD5

1ab607240973a2b7e034cb420f09e2bf
SHA1

4729149bc31bc5cbded1f8a0be4a11e9f868aa36
SHA256

f692935cf773826e02ded659397761a2dcac760ded63c10f7ceb2ec55b6e986a
SHA512

eda585e4dad0af48bd66faa6bf20bacf8b4ddb457bf7c8647118587ef1a96ae6ce36da45023c81625ba90c89c802844d5f6a0449e3b55711093e18e94cf2d919
SSDEEP

384:CLb2vRuSfVqptUK8PC2DND7UuGSXvX/IFwgLHs9RNXXoGNVx:C20SYpJ8PC257UuG8vPgDsF4GP

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msdebug.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msdebug.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	2328	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2328	rundll32.exe
2328	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2328	2368	rundll32.exe	28
PID 2368 wrote to memory of 2328	2368	rundll32.exe	28
PID 2368 wrote to memory of 2328	2368	rundll32.exe	28
PID 2368 wrote to memory of 2328	2368	rundll32.exe	28
PID 2368 wrote to memory of 2328	2368	rundll32.exe	28
PID 2368 wrote to memory of 2328	2368	rundll32.exe	28
PID 2368 wrote to memory of 2328	2368	rundll32.exe	28
PID 2328 wrote to memory of 3020	2328	rundll32.exe	29
PID 2328 wrote to memory of 3020	2328	rundll32.exe	29
PID 2328 wrote to memory of 3020	2328	rundll32.exe	29
PID 2328 wrote to memory of 3020	2328	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ab607240973a2b7e034cb420f09e2bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ab607240973a2b7e034cb420f09e2bf.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 228
    3⤵
    - Program crash
    PID:3020

memory/2328-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2328-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2328-2-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2328-4-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download