1cdb44259b0b294e89f1f89a5691f1c6511a4a6830671ec86c9bfc5b01d45b10

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 15:10

Target

1cdb44259b0b294e89f1f89a5691f1c6511a4a6830671ec86c9bfc5b01d45b10.dll
Size

50KB
MD5

823a5709c53c8a64d62ccd3121f0c0e9
SHA1

924b02537a04edc69dc5fb3b5983a486687cb197
SHA256

1cdb44259b0b294e89f1f89a5691f1c6511a4a6830671ec86c9bfc5b01d45b10
SHA512

a76bbd4ba521883f0b79452302c84230fe423d15feefc40ea5503d7fa61d443f19b55c87a9e2e257c8069b476fd6cfd3ff6fb005bab1c3d95e0255c3bc76e13b
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5AJYH:W5ReWjTrW9rNPgYoGJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1540	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1540	2488	rundll32.exe	28
PID 2488 wrote to memory of 1540	2488	rundll32.exe	28
PID 2488 wrote to memory of 1540	2488	rundll32.exe	28
PID 2488 wrote to memory of 1540	2488	rundll32.exe	28
PID 2488 wrote to memory of 1540	2488	rundll32.exe	28
PID 2488 wrote to memory of 1540	2488	rundll32.exe	28
PID 2488 wrote to memory of 1540	2488	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cdb44259b0b294e89f1f89a5691f1c6511a4a6830671ec86c9bfc5b01d45b10.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cdb44259b0b294e89f1f89a5691f1c6511a4a6830671ec86c9bfc5b01d45b10.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1540