97a44dea075a9407f35aeca9273cf993b11471ec544ddf2cbcb5adc0f439a66a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 12:08

Target

97a44dea075a9407f35aeca9273cf993b11471ec544ddf2cbcb5adc0f439a66a.dll
Size

51KB
MD5

0c8150a1bbb297e767004dafdaa0440f
SHA1

312fd47dde4a4f429ab65b45e0cc11ec0593b8b6
SHA256

97a44dea075a9407f35aeca9273cf993b11471ec544ddf2cbcb5adc0f439a66a
SHA512

ace349f211775c7e6daf504ea335dfe01751cca5f16582a3a3a36a082c4c774d73640c301d70b74349bebda5742a35adebd263c4c0f0d7cc95542311faf307b1
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL9JYH5:1dWubF3n9S91BF3fboxJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
308	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 308	2324	rundll32.exe	28
PID 2324 wrote to memory of 308	2324	rundll32.exe	28
PID 2324 wrote to memory of 308	2324	rundll32.exe	28
PID 2324 wrote to memory of 308	2324	rundll32.exe	28
PID 2324 wrote to memory of 308	2324	rundll32.exe	28
PID 2324 wrote to memory of 308	2324	rundll32.exe	28
PID 2324 wrote to memory of 308	2324	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97a44dea075a9407f35aeca9273cf993b11471ec544ddf2cbcb5adc0f439a66a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97a44dea075a9407f35aeca9273cf993b11471ec544ddf2cbcb5adc0f439a66a.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:308