af04e44b85da8c66a8362d01a70484d98b00f7f8d7d4e78f26dae0d7da5631b1

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 04:15

Target

af04e44b85da8c66a8362d01a70484d98b00f7f8d7d4e78f26dae0d7da5631b1.dll
Size

2.6MB
MD5

4590bbf645666881bd4fac933b5c4168
SHA1

0698fae84cc722a852adcd19a8e65a5c3960d791
SHA256

af04e44b85da8c66a8362d01a70484d98b00f7f8d7d4e78f26dae0d7da5631b1
SHA512

798621c6e90e8b44b558adb5cacfd06622f6cbd1448f603baa8c0f15b62ab493c6c5871005b169ebce7f6cdf31a2156b5b0421c57721bcd41ba7fb726d7638a9
SSDEEP

49152:PSEux2cFn1OiIqNLhery0BcsRMn4zOB5pXhEQTZ1lsc47vgfR2CA0pgJ7sXD+Bm6:aDxxjLI1BcsUWOxegZOHJ7sXD4z

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2392 rundll32.exe

pid	process
2392	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2232 wrote to memory of 2392	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 2392	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 2392	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 2392	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 2392	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 2392	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 2392	2232	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af04e44b85da8c66a8362d01a70484d98b00f7f8d7d4e78f26dae0d7da5631b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af04e44b85da8c66a8362d01a70484d98b00f7f8d7d4e78f26dae0d7da5631b1.dll,#1
2⤵
- Loads dropped DLL
PID:2392

C:\Users\Admin\AppData\Local\Temp\DD6.tmp
C:\Users\Admin\AppData\Local\Temp\DD6.tmp
3⤵
PID:2408

\Users\Admin\AppData\Local\Temp\DD6.tmp
Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/2392-0-0x0000000000CA0000-0x0000000000D6C000-memory.dmp

Filesize
816KB

Download
memory/2392-1-0x0000000000CA0000-0x0000000000D6C000-memory.dmp

Filesize
816KB

Download