7ddf09bc7889a37aa078abdfea68b1f5b476fc78814349272abc41dd5ddd03c1

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 12:11

Target

7ddf09bc7889a37aa078abdfea68b1f5b476fc78814349272abc41dd5ddd03c1.dll
Size

61KB
MD5

ee0d12c337072e386c898975db5ce539
SHA1

0ccad68a2d793407b7035e1b1cfad0f213616c45
SHA256

7ddf09bc7889a37aa078abdfea68b1f5b476fc78814349272abc41dd5ddd03c1
SHA512

ed12c258f271a43527d675f952b8c3e001ade58560269885f179a112de8384355449a15151132893ae9363721eaaa8b31aa932e872021f9838cff432503442af
SSDEEP

1536:JvniYE52GhLqFp2TlvERWCdFnToIfnJ9JIs:JvniYHGhebGlvEndtTBfJ9Jp

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1452	rundll32.exe
32	1452	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rundll32.exe.xxt	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1676	1452	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 1452	228	rundll32.exe	85
PID 228 wrote to memory of 1452	228	rundll32.exe	85
PID 228 wrote to memory of 1452	228	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ddf09bc7889a37aa078abdfea68b1f5b476fc78814349272abc41dd5ddd03c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ddf09bc7889a37aa078abdfea68b1f5b476fc78814349272abc41dd5ddd03c1.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  PID:1452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 768
    3⤵
    - Program crash
    PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1452 -ip 1452
1⤵
PID:2356