8713dc7033b0877593e5176b5e566e9d9895852004962cc17195875ddbf0ae79

Analysis

max time kernel
137s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:29

Target

8713dc7033b0877593e5176b5e566e9d9895852004962cc17195875ddbf0ae79.dll
Size

380KB
MD5

56078c3e7f6ced114fdae30102bda466
SHA1

d1a464a16b1503e88df69950d83c143ea32ef56a
SHA256

8713dc7033b0877593e5176b5e566e9d9895852004962cc17195875ddbf0ae79
SHA512

53855a319059e39776649fbfc196a75f6896ac00527ada5b3d7b8340e49af955ad8cec54032580cea89de81e630858ed5b7fd4fddef8dd87ba16820b7b891916
SSDEEP

6144:WbeDIHoQdT6fKhcdQfYYMXYMPRdl4z7EBSeezvocbsLLAZECsEs3m/b4:WbeU1EKh1mYv7oU2onb4

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\error.log rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\error.log	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3420 wrote to memory of 4464	3420	rundll32.exe	rundll32.exe
PID 3420 wrote to memory of 4464	3420	rundll32.exe	rundll32.exe
PID 3420 wrote to memory of 4464	3420	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8713dc7033b0877593e5176b5e566e9d9895852004962cc17195875ddbf0ae79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3420

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8713dc7033b0877593e5176b5e566e9d9895852004962cc17195875ddbf0ae79.dll,#1
2⤵
- Drops file in System32 directory
PID:4464