116069d8a1764754bfae0db61922190eaac11d9a4882673c1ad52f241a547006

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 14:34

Target

b7a3e11c500f8c5334fe9bc942536d08.dll
Size

275KB
MD5

b7a3e11c500f8c5334fe9bc942536d08
SHA1

e9cc67ec56bd7542f53ce17c994cdfd7197f34ad
SHA256

116069d8a1764754bfae0db61922190eaac11d9a4882673c1ad52f241a547006
SHA512

e3e90fcd09326858068721ffeae2b8e9386e5caecd7443442e3d0d75fd912fe1d7933662dacf7399855f8687febf4ed53f769a827b3ec1ef0f8778751b4d57c8
SSDEEP

384:FSdD9d6Go7LSkJQu84C2qHw2w4aED4Ik99/D3VkWZUJbGzWq6kNUM95X:MkmDEC28w2w/KYh3LUMWq6k2w

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2372 wrote to memory of 1732	2372	rundll32.exe	29
PID 2372 wrote to memory of 1732	2372	rundll32.exe	29
PID 2372 wrote to memory of 1732	2372	rundll32.exe	29
PID 2372 wrote to memory of 1732	2372	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7a3e11c500f8c5334fe9bc942536d08.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7a3e11c500f8c5334fe9bc942536d08.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259396637.bat
    3⤵
    PID:1732

C:\Users\Admin\AppData\Local\Temp\~DFD259396637.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit