7eb6fefdb0399a3418a6c375f436e1a4ce52f5c783baa7c5dc92b3921e3fd91e

Analysis

max time kernel
95s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 05:06

Target
7eb6fefdb0399a3418a6c375f436e1a4ce52f5c783baa7c5dc92b3921e3fd91e.dll
Size 16KB
Sample240225-frqaqada4v
SHA256 7eb6fefdb0399a3418a6c375f436e1a4ce52f5c783baa7c5dc92b3921e3fd91e
MD5 3db26170aa5c06b54c8d60374f59251f
SHA1 648204dc24082ffa498f5627e917f6f64f306730
SHA512 4cc44e8bae2b6e8a85ab04e5b0aa5a2d214233dbcc327994b609b87457659aaa0d2534851508541b4658bd887b2947d15e7e0f9832cdd9460331f821f653e0bb
SSDEEP 192:RniGhkfGBpFH+Z0hZ1WW8B52daFX4/PqfZSCG0GGGdWoBrSKja1cnHs:Y/fAeZ0hZwW42doxR3gWoBrtW1c
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
41	4040	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4040	4724	rundll32.exe	60
PID 4724 wrote to memory of 4040	4724	rundll32.exe	60
PID 4724 wrote to memory of 4040	4724	rundll32.exe	60

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7eb6fefdb0399a3418a6c375f436e1a4ce52f5c783baa7c5dc92b3921e3fd91e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7eb6fefdb0399a3418a6c375f436e1a4ce52f5c783baa7c5dc92b3921e3fd91e.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:4040