c94d8063e97908ac2e73439cb0ded15e49a7f2ad26eedf2f7e840c9b417579ac

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 22:18

Target
c94d8063e97908ac2e73439cb0ded15e49a7f2ad26eedf2f7e840c9b417579ac.dll
Size 51KB
Sample240422-1769dsha86
SHA256 c94d8063e97908ac2e73439cb0ded15e49a7f2ad26eedf2f7e840c9b417579ac
MD5 7928cbe5e4c973444706ee435003d087
SHA1 c25220fea87847a4a6f5962ea5e3da7d35999340
SHA512 1284aa821497c2d798b43b7ad20d6182084f76fb56b497c676d44082b0a7e7091b7f819073247c7c3cfdc7d84dc188b7ea18df609e303c8657bb9622179ef70f
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL5JYH5:1dWubF3n9S91BF3fboNJYH5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2192	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2192	1632	rundll32.exe	28
PID 1632 wrote to memory of 2192	1632	rundll32.exe	28
PID 1632 wrote to memory of 2192	1632	rundll32.exe	28
PID 1632 wrote to memory of 2192	1632	rundll32.exe	28
PID 1632 wrote to memory of 2192	1632	rundll32.exe	28
PID 1632 wrote to memory of 2192	1632	rundll32.exe	28
PID 1632 wrote to memory of 2192	1632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c94d8063e97908ac2e73439cb0ded15e49a7f2ad26eedf2f7e840c9b417579ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c94d8063e97908ac2e73439cb0ded15e49a7f2ad26eedf2f7e840c9b417579ac.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2192