7f1474fd97fa65afbb57e88c2c047fff400ac63c38a09929152b90d76e8b3728

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 04:42

Target

9880170d40bdb2febb6935fc02011315.dll
Size

84KB
MD5

9880170d40bdb2febb6935fc02011315
SHA1

598a7ca1f1d19f57b3f0c656a5462d60c73b7bb9
SHA256

7f1474fd97fa65afbb57e88c2c047fff400ac63c38a09929152b90d76e8b3728
SHA512

51920aa625812eebf53087189bf0869562be50f0d9f261064f850843c9e55c472d4468264671a65eca9dc0d01e2812ebf62b53148c654ed2c1175ae75aaf1b3a
SSDEEP

1536:xyXpW8Yxc4twuyTwBy76mEw/ttFrYX1jNksGk05cwzUPkyL8d:xyZLYm4WuyTv72w/jFrQ1Z+k05bzSTL0

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1632	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1632	3048	rundll32.exe	28
PID 3048 wrote to memory of 1632	3048	rundll32.exe	28
PID 3048 wrote to memory of 1632	3048	rundll32.exe	28
PID 3048 wrote to memory of 1632	3048	rundll32.exe	28
PID 3048 wrote to memory of 1632	3048	rundll32.exe	28
PID 3048 wrote to memory of 1632	3048	rundll32.exe	28
PID 3048 wrote to memory of 1632	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9880170d40bdb2febb6935fc02011315.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9880170d40bdb2febb6935fc02011315.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632