45d9cb3473c201ccd0be9d8fd808c0a778b3fe9fa71dcee8d6efb31c970e702f

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 15:17

Target

45d9cb3473c201ccd0be9d8fd808c0a778b3fe9fa71dcee8d6efb31c970e702f.dll
Size

51KB
MD5

46d41cbf38ba344dd6c31733d968dea0
SHA1

ac7952ddfd8055ac40d92b23118581cc0f5b670e
SHA256

45d9cb3473c201ccd0be9d8fd808c0a778b3fe9fa71dcee8d6efb31c970e702f
SHA512

37ad2b2738e46c29cda90e13ca534313571f3e55c73f393b06e39f7d8b2f36d812a1dae3c040d41301f94e969d5db88b1f4131c69d0e5e2a39ceaa1368a55ed1
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLfJYH5:1dWubF3n9S91BF3fbozJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2136	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2136	2952	rundll32.exe	28
PID 2952 wrote to memory of 2136	2952	rundll32.exe	28
PID 2952 wrote to memory of 2136	2952	rundll32.exe	28
PID 2952 wrote to memory of 2136	2952	rundll32.exe	28
PID 2952 wrote to memory of 2136	2952	rundll32.exe	28
PID 2952 wrote to memory of 2136	2952	rundll32.exe	28
PID 2952 wrote to memory of 2136	2952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d9cb3473c201ccd0be9d8fd808c0a778b3fe9fa71dcee8d6efb31c970e702f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d9cb3473c201ccd0be9d8fd808c0a778b3fe9fa71dcee8d6efb31c970e702f.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2136