bfd1ae116e75099e0a78735fd3192e01e896052eaa8970c46bd508ab74b01f0b

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-03-2024 19:12

Target

bfd1ae116e75099e0a78735fd3192e01e896052eaa8970c46bd508ab74b01f0b.dll
Size

899KB
MD5

6eb1b53aca7e4fc25ff88ac538de1203
SHA1

78ce52abe4d06fcc76c48628bdb94bf955e6a87c
SHA256

bfd1ae116e75099e0a78735fd3192e01e896052eaa8970c46bd508ab74b01f0b
SHA512

be91fb280293a6a19246ea4fa61d7d8c0a354cd1d4372742655007c569c7bff07901f06502521fc7aab9247e251e6deba5395fef9f23bede3ae3bcf1db5d4e60
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXg:7wqd87Vg

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2268	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2268	2980	rundll32.exe	28
PID 2980 wrote to memory of 2268	2980	rundll32.exe	28
PID 2980 wrote to memory of 2268	2980	rundll32.exe	28
PID 2980 wrote to memory of 2268	2980	rundll32.exe	28
PID 2980 wrote to memory of 2268	2980	rundll32.exe	28
PID 2980 wrote to memory of 2268	2980	rundll32.exe	28
PID 2980 wrote to memory of 2268	2980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfd1ae116e75099e0a78735fd3192e01e896052eaa8970c46bd508ab74b01f0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfd1ae116e75099e0a78735fd3192e01e896052eaa8970c46bd508ab74b01f0b.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2268