f794ee7406057c12cb321a4ab4fbf4d2d6160d760fcc319ee2f6357b61c28645

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 08:14

Target

f794ee7406057c12cb321a4ab4fbf4d2d6160d760fcc319ee2f6357b61c28645.dll
Size

51KB
MD5

73b73611a499ac4dffc0796703692022
SHA1

456985b5c5b0658430d1322079c85b58082817a3
SHA256

f794ee7406057c12cb321a4ab4fbf4d2d6160d760fcc319ee2f6357b61c28645
SHA512

eb05ed0f5eb9555af571166e1f18ae4cf6a71eaba50c5c7e94bac53eb319b83110e962e2095fdd149e36b38e2685c157c0b3396be6329cc9f068ed47df5fef28
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLSJYH5:1dWubF3n9S91BF3fbo+JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2796	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2796	848	rundll32.exe	28
PID 848 wrote to memory of 2796	848	rundll32.exe	28
PID 848 wrote to memory of 2796	848	rundll32.exe	28
PID 848 wrote to memory of 2796	848	rundll32.exe	28
PID 848 wrote to memory of 2796	848	rundll32.exe	28
PID 848 wrote to memory of 2796	848	rundll32.exe	28
PID 848 wrote to memory of 2796	848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f794ee7406057c12cb321a4ab4fbf4d2d6160d760fcc319ee2f6357b61c28645.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f794ee7406057c12cb321a4ab4fbf4d2d6160d760fcc319ee2f6357b61c28645.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2796