8850e284300611ac4bb7f36d3e156236d7baf8bae58ba657ea1a8d6b992eda95

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 00:07

Target

8850e284300611ac4bb7f36d3e156236d7baf8bae58ba657ea1a8d6b992eda95.dll
Size

38KB
MD5

72632cb81b920a2acbd32a969f7d6e3a
SHA1

7d476904a576a0a13d3ddfab9e2799a79c83acd4
SHA256

8850e284300611ac4bb7f36d3e156236d7baf8bae58ba657ea1a8d6b992eda95
SHA512

b2275b66d4c0d0f63e211ffd16c6b560f6d50f5aacc156945fdcae1d3f92d98ae46cd2cd97084114b632c80883120f6f0ff2e90369cbc1bcd3645b012b0ab4a5
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7CsXUN76m2sBVV:WD8w22laSR0V+3CJrVdXO7zJ

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2960 wrote to memory of 3068	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 3068	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 3068	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 3068	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 3068	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 3068	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 3068	2960	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8850e284300611ac4bb7f36d3e156236d7baf8bae58ba657ea1a8d6b992eda95.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8850e284300611ac4bb7f36d3e156236d7baf8bae58ba657ea1a8d6b992eda95.dll,#1
2⤵
- Drops file in System32 directory
PID:3068

memory/3068-4-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3068-3-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3068-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3068-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download