f6aa9a7e90f0e2d8bace15ae2e15ac3fd97ce0e7760548c774c227c4385298b0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 00:56

Target

f6aa9a7e90f0e2d8bace15ae2e15ac3fd97ce0e7760548c774c227c4385298b0.dll
Size

51KB
MD5

3d96362f1128ee3bff413936f2d0904c
SHA1

bc571be8e2b03c7c467a04db76f2ac8e5ac12d23
SHA256

f6aa9a7e90f0e2d8bace15ae2e15ac3fd97ce0e7760548c774c227c4385298b0
SHA512

e7e32937f4d3b333f65052d886e58f4a6b8b878b06e8b2e8376b6b415d3a90ce6ff77b6b649d5571440234f4fc6855b83d614f4746548e229fbcef5cb4264b21
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+XJYH5:1dWubF3n9S91BF3fbo8JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2220	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2220	1968	rundll32.exe	28
PID 1968 wrote to memory of 2220	1968	rundll32.exe	28
PID 1968 wrote to memory of 2220	1968	rundll32.exe	28
PID 1968 wrote to memory of 2220	1968	rundll32.exe	28
PID 1968 wrote to memory of 2220	1968	rundll32.exe	28
PID 1968 wrote to memory of 2220	1968	rundll32.exe	28
PID 1968 wrote to memory of 2220	1968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6aa9a7e90f0e2d8bace15ae2e15ac3fd97ce0e7760548c774c227c4385298b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6aa9a7e90f0e2d8bace15ae2e15ac3fd97ce0e7760548c774c227c4385298b0.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2220