79058dae484c6714a466d4d04407af5f789ba0c318093e1535444eaa0a38bbe3

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:08

Target

2b34967e6fd95c00f4ad8233fad0751c.dll
Size

89KB
MD5

2b34967e6fd95c00f4ad8233fad0751c
SHA1

cb922d9abde81094d37104aaa4c7873538e51a1a
SHA256

79058dae484c6714a466d4d04407af5f789ba0c318093e1535444eaa0a38bbe3
SHA512

b1b9338f4af49aab8366b8137a41c1f331b868ea34730d00e84f16df30da4e25e21133e60bbf2fee31e828bb85b110b8d49eb95c7e46b1a4d445fd9116f9eae2
SSDEEP

1536:81tI/vtdJMj6QEk1Azcv2hAfxnKWpjfpTAZmplsjxN2H:81uVdigmAzc2cxnK+fOZmpls9Nc

Score

1^/10

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
484	Process not Found
484	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b34967e6fd95c00f4ad8233fad0751c.dll,#1
1⤵
PID:2992

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b34967e6fd95c00f4ad8233fad0751c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988