56a539b0105f8c14c22cf6578f022777bb475c347cfd8a721de6c3764a5835cb

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:41

Target

3683b940ec72e1ceef98987d93188f13.dll
Size

12KB
MD5

3683b940ec72e1ceef98987d93188f13
SHA1

5b690211b70ecdc489b060f339f9027b6163e3fa
SHA256

56a539b0105f8c14c22cf6578f022777bb475c347cfd8a721de6c3764a5835cb
SHA512

6615419b37ffcdf3273ae51408872103441d0f3253bc7a528f02f3456848d0c53ec5be089647fee8458fa3267b9e9564ec1798075584339ab86e7339a750cde2
SSDEEP

192:DxSKDmco6XCHnCyHGzkDeaLYdVcK1o9+9mrT7TMyLcPG6Or/TndFk87XhLA9Rkgw:9SXwMC4cV51U+K7NYPG6Kdh7X9AUBG6

Score

1^/10

Suspicious behavior: LoadsDriver 13 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2528	2636	rundll32.exe	27
PID 2636 wrote to memory of 2528	2636	rundll32.exe	27
PID 2636 wrote to memory of 2528	2636	rundll32.exe	27
PID 2636 wrote to memory of 2528	2636	rundll32.exe	27
PID 2636 wrote to memory of 2528	2636	rundll32.exe	27
PID 2636 wrote to memory of 2528	2636	rundll32.exe	27
PID 2636 wrote to memory of 2528	2636	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3683b940ec72e1ceef98987d93188f13.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3683b940ec72e1ceef98987d93188f13.dll,#1
  2⤵
  PID:2528

C:\Users\Admin\AppData\Local\Temp\tmpA825.tmp

Filesize
3KB

MD5
bf09e6ac3e32f0a13fe9e3a162af7414

SHA1
d9b287eb34b3a8f8953db6736b210bf479a5161c

SHA256
862a12b9a36980aaf4c29c226543caa02f124a3ee2595dbc10ca65d6cb3c8ad2

SHA512
28f7fc863fab17492d8234dcdcab12b808eef36ef7bb23f004ccf1ee455507395273be858493f4db13bc9ebf616e6d9c9739e45bcca090c3dea3f34a1283c26a

Download Submit
C:\name.log

Filesize
60B

MD5
a764045c1199b36daa0811698ce1f92b

SHA1
9f367bac911d786b9d44e52585cb71afb24e7967

SHA256
5bee6dee7219fe42b556542a3fdec752f259c5375ccdf02f6fdef07ce5e07d52

SHA512
444fb66a75a5695127f881c6fb98920769e562213c7a9700af1d79eabd3753609b9caf787ad4c06bac9d72d0eaff40d32073fb368d104d787c06c78aaa6ecf10

Download Submit
memory/2528-2-0x0000000025000000-0x000000002501A000-memory.dmp

Filesize
104KB

Download