f21a9fc069a63b24fe944a903d7b2dc6e417c06656160b3e96c90433340e0e7e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 23:22

Target

f21a9fc069a63b24fe944a903d7b2dc6e417c06656160b3e96c90433340e0e7e.dll
Size

51KB
MD5

4338d4318d51be09f5314df8fc313b8b
SHA1

eb63d58164d566340050e538e3a533e1c4d67e45
SHA256

f21a9fc069a63b24fe944a903d7b2dc6e417c06656160b3e96c90433340e0e7e
SHA512

22ac2084211bfc6881634a216c6736fd2cad490000fb88e1fdd4a86ec93d2f5e34c4f7d0b642ff6e93023afad2a49c2df668c79f50de440350fc657c4c313481
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLtJYH5:1dWubF3n9S91BF3fboZJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1264	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1264	2740	rundll32.exe	28
PID 2740 wrote to memory of 1264	2740	rundll32.exe	28
PID 2740 wrote to memory of 1264	2740	rundll32.exe	28
PID 2740 wrote to memory of 1264	2740	rundll32.exe	28
PID 2740 wrote to memory of 1264	2740	rundll32.exe	28
PID 2740 wrote to memory of 1264	2740	rundll32.exe	28
PID 2740 wrote to memory of 1264	2740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f21a9fc069a63b24fe944a903d7b2dc6e417c06656160b3e96c90433340e0e7e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f21a9fc069a63b24fe944a903d7b2dc6e417c06656160b3e96c90433340e0e7e.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1264