1422d2db9fbe8b3e32d49c6e9fbfe5b4cceef34b807f8e72075484e6d9d4b013

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 10:12

Target

1422d2db9fbe8b3e32d49c6e9fbfe5b4cceef34b807f8e72075484e6d9d4b013.dll
Size

899KB
MD5

5f3c7c07ef11b7ee3999ec6c4824a9b2
SHA1

f6347d634c557fbba3966bb4ec9ea50cd4d44b21
SHA256

1422d2db9fbe8b3e32d49c6e9fbfe5b4cceef34b807f8e72075484e6d9d4b013
SHA512

b18b70d905fb1067925278eb490c8c96bb25740e0e0abb0c334e10b6ae1ee3e5ba2310d0af10ed161b5fbe5dcdf1f93502a90200a059907cf9b7c1cdb77469e7
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX4:7wqd87V4

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2324	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2324	2220	rundll32.exe	28
PID 2220 wrote to memory of 2324	2220	rundll32.exe	28
PID 2220 wrote to memory of 2324	2220	rundll32.exe	28
PID 2220 wrote to memory of 2324	2220	rundll32.exe	28
PID 2220 wrote to memory of 2324	2220	rundll32.exe	28
PID 2220 wrote to memory of 2324	2220	rundll32.exe	28
PID 2220 wrote to memory of 2324	2220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1422d2db9fbe8b3e32d49c6e9fbfe5b4cceef34b807f8e72075484e6d9d4b013.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1422d2db9fbe8b3e32d49c6e9fbfe5b4cceef34b807f8e72075484e6d9d4b013.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2324