9b8033dc197f445c94dbf4551f4acf067c5692ac4ed3aec5a9320500535dc99c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 01:20

Target

c21916643c5f5768c02d54b3d4337418.dll
Size

24KB
MD5

c21916643c5f5768c02d54b3d4337418
SHA1

5eb1419c47e95d0f565328b55a0b5f339eccff5e
SHA256

9b8033dc197f445c94dbf4551f4acf067c5692ac4ed3aec5a9320500535dc99c
SHA512

fdac3eff1bf2a33f38e922550954fde7453934d3607e6487725563121a48ecfd38c864b793d4fa9f71d258f9601bf550b606cf87409b0b7dcd9bef2cff9a076b
SSDEEP

384:CDmVxz0CA8pqd+1IFQOO5GiOYx3dMoA8j1Wu/EzSxzrBNWO0nvJxZ1Nm4fJ3TWBj:+5CAsqdSEQ38iOy3Lj1WzgrW7xZ1suLE

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2740	rundll32.exe
2740	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2740	1756	rundll32.exe	28
PID 1756 wrote to memory of 2740	1756	rundll32.exe	28
PID 1756 wrote to memory of 2740	1756	rundll32.exe	28
PID 1756 wrote to memory of 2740	1756	rundll32.exe	28
PID 1756 wrote to memory of 2740	1756	rundll32.exe	28
PID 1756 wrote to memory of 2740	1756	rundll32.exe	28
PID 1756 wrote to memory of 2740	1756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c21916643c5f5768c02d54b3d4337418.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c21916643c5f5768c02d54b3d4337418.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740

memory/2740-0-0x00000000001B0000-0x00000000001BB000-memory.dmp

Filesize
44KB

Download
memory/2740-1-0x00000000001B0000-0x00000000001BB000-memory.dmp

Filesize
44KB

Download