238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 16:14

Target
6772.dll
Size 840KB
Sample240306-tpzy2ada9s
SHA256 238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646
MD5 4b1518535af6344af39bd90aa02a6c0d
SHA1 183b74ec94b19c1f4af194e4d606270053669913
SHA512 8644ec984504f56336fe583c61f4e86c103550eb9f8cf27c6342251da13ef2d0dff132bd2256fbe8e1958da788e0f9738636e9b1438851784934427ec7006cb0
SSDEEP 24576:je9nfmpSVmL+Cf72yb1SFEtEfPmY4uRD7HpUMhOw8ghE:qBmpSVmLfCDfPJ4cDFPhmghE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2388	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2388	2340	rundll32.exe	27
PID 2340 wrote to memory of 2388	2340	rundll32.exe	27
PID 2340 wrote to memory of 2388	2340	rundll32.exe	27
PID 2340 wrote to memory of 2388	2340	rundll32.exe	27
PID 2340 wrote to memory of 2388	2340	rundll32.exe	27
PID 2340 wrote to memory of 2388	2340	rundll32.exe	27
PID 2340 wrote to memory of 2388	2340	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6772.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6772.dll,#1
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2388

memory/2388-0-0x0000000000230000-0x0000000000266000-memory.dmp

Download

memory/2388-1-0x0000000000230000-0x0000000000266000-memory.dmp

Download