4c3252d672737caab5ea2bf0866abd5155884b8777dd2e20dd6a969be1564485

Analysis

max time kernel
143s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 10:19

Target

4c3252d672737caab5ea2bf0866abd5155884b8777dd2e20dd6a969be1564485.dll
Size

51KB
MD5

4ad5d829afbe5c7f8c8b83edf359185d
SHA1

9982fed1ebfdeca59a422f8ad7a9cbdaac4bafcb
SHA256

4c3252d672737caab5ea2bf0866abd5155884b8777dd2e20dd6a969be1564485
SHA512

daa37dd70fc21fb76a9c458928b8da2441e03611ea193ad73e245b451751f221de0c0664c70f5498ccaa76a8519b1c137995ec28a169d72af6a4054af8c9d140
SSDEEP

768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezqsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOBtpMC6H

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2848	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2848	1524	rundll32.exe	28
PID 1524 wrote to memory of 2848	1524	rundll32.exe	28
PID 1524 wrote to memory of 2848	1524	rundll32.exe	28
PID 1524 wrote to memory of 2848	1524	rundll32.exe	28
PID 1524 wrote to memory of 2848	1524	rundll32.exe	28
PID 1524 wrote to memory of 2848	1524	rundll32.exe	28
PID 1524 wrote to memory of 2848	1524	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c3252d672737caab5ea2bf0866abd5155884b8777dd2e20dd6a969be1564485.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c3252d672737caab5ea2bf0866abd5155884b8777dd2e20dd6a969be1564485.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2848

memory/2848-0-0x0000000075240000-0x0000000075250000-memory.dmp

Filesize
64KB

Download