6b39628254996caf6313d9eb5548b519b5d80f385171760da65c806b4c8d3e74

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 00:06

Target

6b39628254996caf6313d9eb5548b519b5d80f385171760da65c806b4c8d3e74.dll
Size

51KB
MD5

6f6163e7170ac0a42b08e2defddef103
SHA1

453718831e62c674e310972ff931ed408d337a2b
SHA256

6b39628254996caf6313d9eb5548b519b5d80f385171760da65c806b4c8d3e74
SHA512

96cb238ceaf143a25b8bba5d95f3100a1eec89bf9b25d20b1d5727da45f26de88e6a42d047e397206ba5412e412a3d303f322454d95c34dd246573a69fb21f0c
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL1JYH5:1dWubF3n9S91BF3fboZJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2928	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2928	2524	rundll32.exe	28
PID 2524 wrote to memory of 2928	2524	rundll32.exe	28
PID 2524 wrote to memory of 2928	2524	rundll32.exe	28
PID 2524 wrote to memory of 2928	2524	rundll32.exe	28
PID 2524 wrote to memory of 2928	2524	rundll32.exe	28
PID 2524 wrote to memory of 2928	2524	rundll32.exe	28
PID 2524 wrote to memory of 2928	2524	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b39628254996caf6313d9eb5548b519b5d80f385171760da65c806b4c8d3e74.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b39628254996caf6313d9eb5548b519b5d80f385171760da65c806b4c8d3e74.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2928