aedf792eb9cbd91013e5e1904cc1e3e8338c779d0e110593d864e29281d59f19

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:53

Target

aedf792eb9cbd91013e5e1904cc1e3e8338c779d0e110593d864e29281d59f19.dll
Size

38KB
MD5

9d5db017dde79b957a9c7c639a470b6c
SHA1

9b8c9c762068bd8ec650f806bb80bc2c042a5303
SHA256

aedf792eb9cbd91013e5e1904cc1e3e8338c779d0e110593d864e29281d59f19
SHA512

cbf93f004b9274a4330089f14f37ad41eb8b5a2113cd142ba4c74dc004cc0082b2580de088d06d813289ab1cf8346a198e97cc78d5ec6909fb34760485132e61
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7IhXUWe6m2sgQVV:WD8w22laSR0V+3CJrV6XOzJg

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2140 wrote to memory of 2132	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 2132	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 2132	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 2132	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 2132	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 2132	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 2132	2140	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aedf792eb9cbd91013e5e1904cc1e3e8338c779d0e110593d864e29281d59f19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aedf792eb9cbd91013e5e1904cc1e3e8338c779d0e110593d864e29281d59f19.dll,#1
2⤵
- Drops file in System32 directory
PID:2132

memory/2132-3-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2132-4-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2132-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2132-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download