8b3b69dc7303d2faf8153ff2d3158686b6488bab8ed64ae85a32c3d6ea89fb38

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 10:29

Target

8b3b69dc7303d2faf8153ff2d3158686b6488bab8ed64ae85a32c3d6ea89fb38.dll
Size

51KB
MD5

a50cf1d580df0e4400078d6f4a9f59ba
SHA1

7e4268678a8c11ba5515350b1eabf1541ff785d1
SHA256

8b3b69dc7303d2faf8153ff2d3158686b6488bab8ed64ae85a32c3d6ea89fb38
SHA512

78383d750fb9b3728584ee55fbdcce6de1086b8a138f2cf8310776121b6573ef5e3c8e48837c1b517980cb1f8e1a4e69642c4f85962991bc8eee80cf71238b84
SSDEEP

768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezZsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOB6pMC6H

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2552	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2552	2912	rundll32.exe	28
PID 2912 wrote to memory of 2552	2912	rundll32.exe	28
PID 2912 wrote to memory of 2552	2912	rundll32.exe	28
PID 2912 wrote to memory of 2552	2912	rundll32.exe	28
PID 2912 wrote to memory of 2552	2912	rundll32.exe	28
PID 2912 wrote to memory of 2552	2912	rundll32.exe	28
PID 2912 wrote to memory of 2552	2912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b3b69dc7303d2faf8153ff2d3158686b6488bab8ed64ae85a32c3d6ea89fb38.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b3b69dc7303d2faf8153ff2d3158686b6488bab8ed64ae85a32c3d6ea89fb38.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2552

memory/2552-0-0x0000000075180000-0x0000000075190000-memory.dmp

Filesize
64KB

Download