aa846555595867a997a1e5e3d8a2b62a84bf35c5b06b1ed3bbef63a44b4241b0

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 21:36

Target

aa846555595867a997a1e5e3d8a2b62a84bf35c5b06b1ed3bbef63a44b4241b0.dll
Size

51KB
MD5

d5ea66c68ecbbb8a6a0d2796a19a8db9
SHA1

ebbaccd4dfb17dbb5145e76a4e68153d1a507e77
SHA256

aa846555595867a997a1e5e3d8a2b62a84bf35c5b06b1ed3bbef63a44b4241b0
SHA512

a3c6a33652f13d21c45ccaf19e4a509fb695f623b2b2fe39db2b7a8477f10eb910b8af5d674d964dd303d940e0427f5b48ac6da5ae6541be67cbe62f8e1ae7ea
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL9JYH5:1dWubF3n9S91BF3fboJJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1396	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 1396	2652	rundll32.exe	28
PID 2652 wrote to memory of 1396	2652	rundll32.exe	28
PID 2652 wrote to memory of 1396	2652	rundll32.exe	28
PID 2652 wrote to memory of 1396	2652	rundll32.exe	28
PID 2652 wrote to memory of 1396	2652	rundll32.exe	28
PID 2652 wrote to memory of 1396	2652	rundll32.exe	28
PID 2652 wrote to memory of 1396	2652	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa846555595867a997a1e5e3d8a2b62a84bf35c5b06b1ed3bbef63a44b4241b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa846555595867a997a1e5e3d8a2b62a84bf35c5b06b1ed3bbef63a44b4241b0.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1396