ab8b6d998bb163c5253deee68f3fe5a36a47ea3436bcb58c54e6365d7abe6474

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 04:19

Target

ab8b6d998bb163c5253deee68f3fe5a36a47ea3436bcb58c54e6365d7abe6474.dll
Size

50KB
MD5

0b921a745bb3c077984ec5a228bbc87e
SHA1

fd216aabf7b2bec83289c8cf8e750c13ab49e818
SHA256

ab8b6d998bb163c5253deee68f3fe5a36a47ea3436bcb58c54e6365d7abe6474
SHA512

0fc79350b50764a66b3357aca332fff7b2c0cd8f2ed8020738f7dc337c7d6414a199166feb738a6f9b9a73b3787765c9de3cc04d7013eb9635e64ae7072a47d8
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5wJYH:W5ReWjTrW9rNPgYoeJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1612	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1612	2200	rundll32.exe	28
PID 2200 wrote to memory of 1612	2200	rundll32.exe	28
PID 2200 wrote to memory of 1612	2200	rundll32.exe	28
PID 2200 wrote to memory of 1612	2200	rundll32.exe	28
PID 2200 wrote to memory of 1612	2200	rundll32.exe	28
PID 2200 wrote to memory of 1612	2200	rundll32.exe	28
PID 2200 wrote to memory of 1612	2200	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab8b6d998bb163c5253deee68f3fe5a36a47ea3436bcb58c54e6365d7abe6474.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab8b6d998bb163c5253deee68f3fe5a36a47ea3436bcb58c54e6365d7abe6474.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1612