a3aaabc35d710dc0e559501bfe1341f077ce9e41794d70ecf5ac4b9dc9391f66

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 14:14

Target

a3aaabc35d710dc0e559501bfe1341f077ce9e41794d70ecf5ac4b9dc9391f66.dll
Size

50KB
MD5

46d932884b50817a44e92ff222bf4c0a
SHA1

e27c45511499bbfa2fc2e9de7bfdb69cc6ddaeea
SHA256

a3aaabc35d710dc0e559501bfe1341f077ce9e41794d70ecf5ac4b9dc9391f66
SHA512

58383920c7e67ea6fc48376bd4aa1c9f77e424612e9c94c146f9b3afec2b92ee93aa1dce85337b91e30e52be01e66a589b1f087f43d3c75aebccc6915072c57b
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o59JYH:W5ReWjTrW9rNPgYoPJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2512	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2512	2960	rundll32.exe	28
PID 2960 wrote to memory of 2512	2960	rundll32.exe	28
PID 2960 wrote to memory of 2512	2960	rundll32.exe	28
PID 2960 wrote to memory of 2512	2960	rundll32.exe	28
PID 2960 wrote to memory of 2512	2960	rundll32.exe	28
PID 2960 wrote to memory of 2512	2960	rundll32.exe	28
PID 2960 wrote to memory of 2512	2960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3aaabc35d710dc0e559501bfe1341f077ce9e41794d70ecf5ac4b9dc9391f66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3aaabc35d710dc0e559501bfe1341f077ce9e41794d70ecf5ac4b9dc9391f66.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2512