ca61bf6c51295ffd1b62b4c7fb3c6c3b81b819fde40b4e3f6fceb9fa8446a27a

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 09:29

Target

ca61bf6c51295ffd1b62b4c7fb3c6c3b81b819fde40b4e3f6fceb9fa8446a27a.dll
Size

51KB
MD5

d696882706b4e43c7a70a8bae63e790d
SHA1

671ebf9d75de22b0f7dc421bed2135f43cfddf20
SHA256

ca61bf6c51295ffd1b62b4c7fb3c6c3b81b819fde40b4e3f6fceb9fa8446a27a
SHA512

f5ba8d05ec7a3e5e696559cf0f4a07ef8f5a9599e7cbf44899cb6084c43c1319ee680e1ae3f9d2526b0bb67457a8e31e09adcffff9d8ad1a2c5b63a01605ade4
SSDEEP

768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezvsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOBUpMC6H

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3024	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3024	3012	rundll32.exe	28
PID 3012 wrote to memory of 3024	3012	rundll32.exe	28
PID 3012 wrote to memory of 3024	3012	rundll32.exe	28
PID 3012 wrote to memory of 3024	3012	rundll32.exe	28
PID 3012 wrote to memory of 3024	3012	rundll32.exe	28
PID 3012 wrote to memory of 3024	3012	rundll32.exe	28
PID 3012 wrote to memory of 3024	3012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca61bf6c51295ffd1b62b4c7fb3c6c3b81b819fde40b4e3f6fceb9fa8446a27a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca61bf6c51295ffd1b62b4c7fb3c6c3b81b819fde40b4e3f6fceb9fa8446a27a.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3024

memory/3024-0-0x00000000745C0000-0x00000000745D0000-memory.dmp

Filesize
64KB

Download