dfd19222ea67d22abd2db76956849753e2c8caa5556105d193295fc7c74d410a

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 19:36

Target

dfd19222ea67d22abd2db76956849753e2c8caa5556105d193295fc7c74d410a.dll
Size

899KB
MD5

1d3628c0cd2548204f8191c7d847724e
SHA1

61eecf66b312558644f9f663c24c4689c7cf71c0
SHA256

dfd19222ea67d22abd2db76956849753e2c8caa5556105d193295fc7c74d410a
SHA512

38fb82a5996cda1ddbd5bb8086898e5dd4e9c95c64a5037191669009cb2747f9ae5d34ed61c8413ca20471e8005208d8a18d90fc980e0c9470f1703d3331b96e
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX2:7wqd87V2

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2600	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2600	2120	rundll32.exe	28
PID 2120 wrote to memory of 2600	2120	rundll32.exe	28
PID 2120 wrote to memory of 2600	2120	rundll32.exe	28
PID 2120 wrote to memory of 2600	2120	rundll32.exe	28
PID 2120 wrote to memory of 2600	2120	rundll32.exe	28
PID 2120 wrote to memory of 2600	2120	rundll32.exe	28
PID 2120 wrote to memory of 2600	2120	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfd19222ea67d22abd2db76956849753e2c8caa5556105d193295fc7c74d410a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfd19222ea67d22abd2db76956849753e2c8caa5556105d193295fc7c74d410a.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2600