3d9204546bc6cb2b39f0913967468d8fdb98a345b771aa8644dd1f4fb25b99d3

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 01:49

Target

642af97118fbe90487e2c143bda094dd.dll
Size

20KB
MD5

642af97118fbe90487e2c143bda094dd
SHA1

d94bb9e3f3a017a4109a0c43bbbe4228cd7fb3d8
SHA256

3d9204546bc6cb2b39f0913967468d8fdb98a345b771aa8644dd1f4fb25b99d3
SHA512

45b67f10af64da02f844e7f1f314aafaadc26fca70332627aeebdf6dc79e271e04ab45aaf868a323de1cbd768ff54273a526bca435783a46da3a9dc984befb2c
SSDEEP

384:ZnUKkhw5AshmDRDQ8gciOck9mFWUDKcefvziuE/ymsI5y20b:JXk8uDRDtgciOn9mUUDpEvziuE/ymsIU

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\windhcp.ocx	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\windhcp.ocx	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2404	2900	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2900	rundll32.exe
2900	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2900	1152	rundll32.exe	28
PID 1152 wrote to memory of 2900	1152	rundll32.exe	28
PID 1152 wrote to memory of 2900	1152	rundll32.exe	28
PID 1152 wrote to memory of 2900	1152	rundll32.exe	28
PID 1152 wrote to memory of 2900	1152	rundll32.exe	28
PID 1152 wrote to memory of 2900	1152	rundll32.exe	28
PID 1152 wrote to memory of 2900	1152	rundll32.exe	28
PID 2900 wrote to memory of 2404	2900	rundll32.exe	29
PID 2900 wrote to memory of 2404	2900	rundll32.exe	29
PID 2900 wrote to memory of 2404	2900	rundll32.exe	29
PID 2900 wrote to memory of 2404	2900	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\642af97118fbe90487e2c143bda094dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\642af97118fbe90487e2c143bda094dd.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 228
    3⤵
    - Program crash
    PID:2404

memory/2900-0-0x0000000002000000-0x0000000002011000-memory.dmp

Filesize
68KB

Download
memory/2900-1-0x0000000002000000-0x0000000002011000-memory.dmp

Filesize
68KB

Download
memory/2900-2-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2900-4-0x0000000002000000-0x0000000002011000-memory.dmp

Filesize
68KB

Download