3490139b9df280e64b48ebc3c035d5050a783a1d4a82dadb490cad559ed34075

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23/04/2024, 02:35

Target

3490139b9df280e64b48ebc3c035d5050a783a1d4a82dadb490cad559ed34075.dll
Size

50KB
MD5

4e4a2277f5b0cc08a383c8ed5eaf3086
SHA1

35bb9cc81d4ad9289775fb29e5b455fa88227f9a
SHA256

3490139b9df280e64b48ebc3c035d5050a783a1d4a82dadb490cad559ed34075
SHA512

eb62c4757a351e74c98baa38a03206154925f8d68b1a0417faf3530a1930d62f0673d75b5de87a5fcd48ac77bcd54364f70a26121945364de71c87a8bfa6eb2f
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5HJYH:W5ReWjTrW9rNPgYo9JYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1472	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28
PID 2040 wrote to memory of 1472	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3490139b9df280e64b48ebc3c035d5050a783a1d4a82dadb490cad559ed34075.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3490139b9df280e64b48ebc3c035d5050a783a1d4a82dadb490cad559ed34075.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1472