74024a2482137ec4b5524c4e3ee08731bb332f425f527e3ca0655024c3917f0b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 14:42

Target

b7a76c1b6624023d8007070b04af2187.dll
Size

148KB
MD5

b7a76c1b6624023d8007070b04af2187
SHA1

470aad208d710880a54438019cf851f990291a13
SHA256

74024a2482137ec4b5524c4e3ee08731bb332f425f527e3ca0655024c3917f0b
SHA512

eccc89055909d81d4ce2e63f1cfe761d6016ae20bb5b053369bbc64efce1ad86f6044bb23d8841151905c8583f13af86396172f61172e7adf2b1f9518cacd7b2
SSDEEP

768:ozKNv+dodMaG4mRHDmyFcVZx3uguBwg52c9viieqDlgUNVN1RiTsZNnRauAHd+PE:i2TyFcLxeguBwqoqDOUDus7nMu2dQE

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepion.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 1108	508	rundll32.exe	87
PID 508 wrote to memory of 1108	508	rundll32.exe	87
PID 508 wrote to memory of 1108	508	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7a76c1b6624023d8007070b04af2187.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7a76c1b6624023d8007070b04af2187.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:1108

memory/1108-0-0x0000000025000000-0x0000000025025000-memory.dmp

Filesize
148KB

Download