5763c798566fb33a345142a6759e516f4f8756f3b67a49c969a015dab4471724

Analysis

max time kernel
135s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 01:29

Target

22e73830310fec4d61cb0b8b18939f6c.dll
Size

94KB
MD5

22e73830310fec4d61cb0b8b18939f6c
SHA1

05839c5d1912e66dbeb86c678856a01fa0cf8063
SHA256

5763c798566fb33a345142a6759e516f4f8756f3b67a49c969a015dab4471724
SHA512

ff8c568abc2d88cb0035876337fb0549e846a7096addad1ec42231a010ebbe70d76b9eb69d82ad08cb3bc4cf6d17ea3ceea3cb5a6c474568d330ffed8043fc25
SSDEEP

1536:uPcIzRdoOvF7UwiMM7UQCXcWHTfBF8w9va3ooKNksR8Oo:4cIA+FIZ7UQCX5HzBF8wMooKNksR8O

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4652	4220	rundll32.exe	89
PID 4220 wrote to memory of 4652	4220	rundll32.exe	89
PID 4220 wrote to memory of 4652	4220	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22e73830310fec4d61cb0b8b18939f6c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22e73830310fec4d61cb0b8b18939f6c.dll,#1
  2⤵
  - Drops file in Drivers directory
  PID:4652