28d48c708d7a3b4741b53f3f362e9121c1822d0bed1fe8ecfe656efd93df9560

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 13:23

Target

28d48c708d7a3b4741b53f3f362e9121c1822d0bed1fe8ecfe656efd93df9560.dll
Size

899KB
MD5

101e965d71ffdb4fbdd7b00b4107338c
SHA1

c2161f3a659279a8d9ba646cce070c987275afc2
SHA256

28d48c708d7a3b4741b53f3f362e9121c1822d0bed1fe8ecfe656efd93df9560
SHA512

787276ed8b70fc8d000b0756e9b5c67f34556c0b341b4694e80caa0e847ed6a64f41dca2c3ab6b0ae01ec4b9bd30f5e7d4bcf72b9494ee4a1da878a07d2155c8
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXD:7wqd87VD

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1448	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1448	2240	rundll32.exe	28
PID 2240 wrote to memory of 1448	2240	rundll32.exe	28
PID 2240 wrote to memory of 1448	2240	rundll32.exe	28
PID 2240 wrote to memory of 1448	2240	rundll32.exe	28
PID 2240 wrote to memory of 1448	2240	rundll32.exe	28
PID 2240 wrote to memory of 1448	2240	rundll32.exe	28
PID 2240 wrote to memory of 1448	2240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28d48c708d7a3b4741b53f3f362e9121c1822d0bed1fe8ecfe656efd93df9560.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28d48c708d7a3b4741b53f3f362e9121c1822d0bed1fe8ecfe656efd93df9560.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1448