4d16b4357b46d5b662cd993edcee00e5c1b0f93ece7e3dd01e04aba0ae0dff49

Analysis

max time kernel
127s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 23:48

Target

4d16b4357b46d5b662cd993edcee00e5c1b0f93ece7e3dd01e04aba0ae0dff49.dll
Size

50KB
MD5

944e53b8dc8ed72276641d8d088ae8a6
SHA1

af00fbba467eedfd9d99789a585cb4969f374cd5
SHA256

4d16b4357b46d5b662cd993edcee00e5c1b0f93ece7e3dd01e04aba0ae0dff49
SHA512

6740114502e2322cea378923307b5fff83af78cdc3a51eafd0090505b60f24e727708b5878e61e5a7bc3cac17394a7ff01cd10d16b620c97f0938bc8ccd6db88
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5OJYH:W5ReWjTrW9rNPgYoUJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1732	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d16b4357b46d5b662cd993edcee00e5c1b0f93ece7e3dd01e04aba0ae0dff49.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d16b4357b46d5b662cd993edcee00e5c1b0f93ece7e3dd01e04aba0ae0dff49.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1732