3b7469b006d9a3a7a429951cf41b02bd4d3ffa736bf35a8fe5ccda3cbadb6820

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07-06-2024 14:42

Target

3b7469b006d9a3a7a429951cf41b02bd4d3ffa736bf35a8fe5ccda3cbadb6820.dll
Size

51KB
MD5

7e892987aac19905335f99c878ca0345
SHA1

4d532473a2341c22de7de320d5457b0992f35772
SHA256

3b7469b006d9a3a7a429951cf41b02bd4d3ffa736bf35a8fe5ccda3cbadb6820
SHA512

9350fceeb847e45e7c62b19ef298ae885b3045d79709c1e311c2afdd95b8629f8422d9bfab4a6db1700edf51fb7928434f77efa20d5b58a745a20639abe87ee0
SSDEEP

768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezVsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOBOpMC6H

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2496	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28
PID 1044 wrote to memory of 2496	1044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b7469b006d9a3a7a429951cf41b02bd4d3ffa736bf35a8fe5ccda3cbadb6820.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b7469b006d9a3a7a429951cf41b02bd4d3ffa736bf35a8fe5ccda3cbadb6820.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2496

memory/2496-0-0x00000000747F0000-0x0000000074800000-memory.dmp

Filesize
64KB

Download