fd73b4adb9d29bed9b8c93b64c674f303596c811caf12cf8d63dd31a5448622a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 18:41

Target

8fdf814c9d25a25dfd9b51d8cf805f3b.dll
Size

128KB
MD5

8fdf814c9d25a25dfd9b51d8cf805f3b
SHA1

da8603742eb94b7654c73bb54bbf7cb758aee0e3
SHA256

fd73b4adb9d29bed9b8c93b64c674f303596c811caf12cf8d63dd31a5448622a
SHA512

7c8f8d39e062a66e6a39f318560ffa67548db1fdf7f9a96503af21366ea86eeb51c9dea5a46666e8762c1811db8e157ed146632977c0516d22a2ef32d5afd397
SSDEEP

1536:dgvFMUT+u0W+9NfY9bjGbhTIkTd0JsZsUdYApm90cVe2wPb5JQ1KyyqBdDXpj4CT:d6LTZ9+nKS8cKYw0OwdcBBdD+CH+m

Score

1^/10

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1888	1696	rundll32.exe	28
PID 1696 wrote to memory of 1888	1696	rundll32.exe	28
PID 1696 wrote to memory of 1888	1696	rundll32.exe	28
PID 1696 wrote to memory of 1888	1696	rundll32.exe	28
PID 1696 wrote to memory of 1888	1696	rundll32.exe	28
PID 1696 wrote to memory of 1888	1696	rundll32.exe	28
PID 1696 wrote to memory of 1888	1696	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fdf814c9d25a25dfd9b51d8cf805f3b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fdf814c9d25a25dfd9b51d8cf805f3b.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1888

memory/1888-0-0x0000000010000000-0x000000001014C000-memory.dmp

Filesize
1.3MB

Download
memory/1888-1-0x0000000010000000-0x000000001014C000-memory.dmp

Filesize
1.3MB

Download
memory/1888-2-0x0000000010000000-0x000000001014C000-memory.dmp

Filesize
1.3MB

Download