340f6232ce926268d1c86332906dac32d4db8440353777d01ea6e59991bf9eb2

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-02-2024 09:33

Target

340f6232ce926268d1c86332906dac32d4db8440353777d01ea6e59991bf9eb2.dll
Size

1.1MB
MD5

b13087b14b944388bcbf301d30e2bef4
SHA1

746d8fcccaf09a58d62d552d2236eceaab100115
SHA256

340f6232ce926268d1c86332906dac32d4db8440353777d01ea6e59991bf9eb2
SHA512

94dec3bc5463da18e4a757553037ced67595a784e13bbae91ea1b59a8c5fac26539844fc6c985c8bc4592c627cfe44cef360fe195ec71c4775a9857f671ca883
SSDEEP

24576:kiD9IKcsUuI8xSNJpo9Gro8o+7wO3IMO7ER8p:P7x8JUO4MO7lp

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1976	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1976	1944	rundll32.exe	28
PID 1944 wrote to memory of 1976	1944	rundll32.exe	28
PID 1944 wrote to memory of 1976	1944	rundll32.exe	28
PID 1944 wrote to memory of 1976	1944	rundll32.exe	28
PID 1944 wrote to memory of 1976	1944	rundll32.exe	28
PID 1944 wrote to memory of 1976	1944	rundll32.exe	28
PID 1944 wrote to memory of 1976	1944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\340f6232ce926268d1c86332906dac32d4db8440353777d01ea6e59991bf9eb2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\340f6232ce926268d1c86332906dac32d4db8440353777d01ea6e59991bf9eb2.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976

memory/1976-0-0x00000000001E0000-0x00000000002F6000-memory.dmp

Filesize
1.1MB

Download