0993a0079667a072f30e3791a499d577e1563cbe4f741d3805d53f041c47088f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 18:29

Target

0993a0079667a072f30e3791a499d577e1563cbe4f741d3805d53f041c47088f.dll
Size

449KB
MD5

0eda6af5009bfc48cd8b57613856d788
SHA1

17d118a9d384ca1bf9854081135b369a6a969f7c
SHA256

0993a0079667a072f30e3791a499d577e1563cbe4f741d3805d53f041c47088f
SHA512

e1c3a7c93527095f00b6fb5457c6bc0be78bb5105fd4ffcaedee9c21e7ca072988757e7c731a9936f7ebe7dffe464767a12c50131a794403f4e510e2adf72879
SSDEEP

12288:G6wxmS3xnmq6lOUXTtdy0jJ1z+8iXfQZ/:G6A/Efp+CZ

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

2012 rundll32.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

rundll32.exe

pid process

2012 rundll32.exe

pid	process
2012	rundll32.exe

pid	process
2012	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2104 wrote to memory of 2012	2104	rundll32.exe	rundll32.exe
PID 2104 wrote to memory of 2012	2104	rundll32.exe	rundll32.exe
PID 2104 wrote to memory of 2012	2104	rundll32.exe	rundll32.exe
PID 2104 wrote to memory of 2012	2104	rundll32.exe	rundll32.exe
PID 2104 wrote to memory of 2012	2104	rundll32.exe	rundll32.exe
PID 2104 wrote to memory of 2012	2104	rundll32.exe	rundll32.exe
PID 2104 wrote to memory of 2012	2104	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0993a0079667a072f30e3791a499d577e1563cbe4f741d3805d53f041c47088f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104

memory/2012-0-0x0000000000231000-0x0000000000235000-memory.dmp

Filesize
16KB

Download