6168f2bd5b82e5bd36fd74db17d0a600675297cc8af8116270d757188f4da854

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 17:20

Target

c6729519147dd5fa64fc621e0e0867a1.dll
Size

368KB
MD5

c6729519147dd5fa64fc621e0e0867a1
SHA1

723af5f224cd7435ed6580e53ce43a6cc479770d
SHA256

6168f2bd5b82e5bd36fd74db17d0a600675297cc8af8116270d757188f4da854
SHA512

e26578a1ec6a61cab460b8aa61576ece93dd71090ff332ecb94992c2afea210bcfa6e4d6572cb1dd784d151e2d240576eff3c60a5def3632f9adbc16a2213236
SSDEEP

6144:9Xi9jNdUIfhr6nLuwTcmhCfIJ9wHtMsr08/1iKe3FZ2yOHlFg0Dn6TJCAzgvLtlW:pi9jNdU8r6nLuMNwH2S1k6hmJ4LtlG4B

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2152	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2152	3020	rundll32.exe	28
PID 3020 wrote to memory of 2152	3020	rundll32.exe	28
PID 3020 wrote to memory of 2152	3020	rundll32.exe	28
PID 3020 wrote to memory of 2152	3020	rundll32.exe	28
PID 3020 wrote to memory of 2152	3020	rundll32.exe	28
PID 3020 wrote to memory of 2152	3020	rundll32.exe	28
PID 3020 wrote to memory of 2152	3020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6729519147dd5fa64fc621e0e0867a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6729519147dd5fa64fc621e0e0867a1.dll,#1
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2152

memory/2152-0-0x0000000001EA0000-0x0000000001EE0000-memory.dmp

Filesize
256KB

Download
memory/2152-1-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2152-2-0x0000000001EA0000-0x0000000001EE0000-memory.dmp

Filesize
256KB

Download
memory/2152-3-0x0000000001EA0000-0x0000000001EE0000-memory.dmp

Filesize
256KB

Download