65d29f6a9c526ed23aab0a6f5ad72633ea8712bf63a8dad38e7b6a8b190a38f7

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 17:57

Target

4c1797ae8d7b639723ead59a0cad884a.dll
Size

13KB
MD5

4c1797ae8d7b639723ead59a0cad884a
SHA1

222ac15ee677bc9c0eb4f52c1de1f9887fb7cbd9
SHA256

65d29f6a9c526ed23aab0a6f5ad72633ea8712bf63a8dad38e7b6a8b190a38f7
SHA512

28824df02eee4500bf99cbad30aef45138bc490b79cb27abfa3bf737b9553ea43df075c1685262249c6c6272962ceb276e88bdc19e418bd8563096a05b96adfb
SSDEEP

384:ZGo/K6i7Zt8c2aso+YxSfVk2EXer4pG8C3ur2XutzP4e:ZGoySaso+Mb2EXeUHCy0iLb

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 1880	2556	rundll32.exe	10
PID 2556 wrote to memory of 1880	2556	rundll32.exe	10
PID 2556 wrote to memory of 1880	2556	rundll32.exe	10
PID 2556 wrote to memory of 1880	2556	rundll32.exe	10
PID 2556 wrote to memory of 1880	2556	rundll32.exe	10
PID 2556 wrote to memory of 1880	2556	rundll32.exe	10
PID 2556 wrote to memory of 1880	2556	rundll32.exe	10

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c1797ae8d7b639723ead59a0cad884a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c1797ae8d7b639723ead59a0cad884a.dll,#1
  2⤵
  PID:1880

memory/1880-0-0x0000000025000000-0x000000002501F000-memory.dmp

Filesize
124KB

Download