d16dddc1e9ad69c5ef67afd93eb801c74ca5b95ec8b46741786c8c8ec47b1b1d

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 14:29

Target

heur001.dll
Size

124KB
MD5

840c8e9d2aaccc87d6dad1d409e45a10
SHA1

41be046bf69a7a5bbf27b224554f42d81f5c9c47
SHA256

68fe6616070f5d5d20b12ff020a6197ae93a93ae06d24bf6e872cc35862f758f
SHA512

ed9bf5b7252e26035e1c5779f7f4a065315970e206dc23463cc7dec07a0e890e0757c757a6ff4d910cff639b911b54b20acd488a2190dcc4ee29628b39eb4012
SSDEEP

3072:WPJLnHOfXoAwOSxoPMVsf0nQla8vxgs2N+r3r+f:WPeRgPvSCsDr3r+f

Score

1^/10

Modifies registry class 3 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2848 wrote to memory of 1692	2848	rundll32.exe	rundll32.exe
PID 2848 wrote to memory of 1692	2848	rundll32.exe	rundll32.exe
PID 2848 wrote to memory of 1692	2848	rundll32.exe	rundll32.exe
PID 2848 wrote to memory of 1692	2848	rundll32.exe	rundll32.exe
PID 2848 wrote to memory of 1692	2848	rundll32.exe	rundll32.exe
PID 2848 wrote to memory of 1692	2848	rundll32.exe	rundll32.exe
PID 2848 wrote to memory of 1692	2848	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 2400	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 2400	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 2400	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 2400	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 2400	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 2400	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 2400	1692	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\heur001.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848

memory/1692-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/1692-1-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/1692-12-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1692-11-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1692-10-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1692-9-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1692-8-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1692-7-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1692-6-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1692-5-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1692-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1692-3-0x00000000001E0000-0x000000000020C000-memory.dmp

Filesize
176KB

Download
memory/1692-2-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download