29bbc79d2a5b1e1c225866578bfe893a74885922a2975bbc0e4974aa652dada4

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 01:57

Target

7123f41cef081285a1eb969899bf06bf.dll
Size

88KB
MD5

7123f41cef081285a1eb969899bf06bf
SHA1

23dd2a15a30141dc198cc6cc04c2ecc2e7088079
SHA256

29bbc79d2a5b1e1c225866578bfe893a74885922a2975bbc0e4974aa652dada4
SHA512

24c4b6cdba0567c16304f969348f4e9ce7212e4f6036fc8644d7f52d5c417f480c3e4bc3efbc969348f5d13a11418f1a54e7927134fc19478c8287af35ea2d8a
SSDEEP

1536:4bTSe5NoOyEgl5tvuGFTvuPWCMRtPLIm51ASX/svv325heVivzH8IUzC1pk:4bTSeSEg5vulPWCMzPLzySXEvvGOVivH

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 5072	3768	rundll32.exe	84
PID 3768 wrote to memory of 5072	3768	rundll32.exe	84
PID 3768 wrote to memory of 5072	3768	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7123f41cef081285a1eb969899bf06bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7123f41cef081285a1eb969899bf06bf.dll,#1
  2⤵
  - Drops file in Drivers directory
  PID:5072

memory/5072-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download