a2024df192c38d050f4ccc518a8f74d0c403892fb12a5a4b8d6d62510e7a4846

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 10:17

Target

a2024df192c38d050f4ccc518a8f74d0c403892fb12a5a4b8d6d62510e7a4846.dll
Size

51KB
MD5

78e55fc0aba75ea2632ac47038ad4b43
SHA1

7ddc99ebcd4dbf2b6ea8b270e3a5a12e3c5774fb
SHA256

a2024df192c38d050f4ccc518a8f74d0c403892fb12a5a4b8d6d62510e7a4846
SHA512

37034fe4b840efcca192060632ff9df2b52a06fb9422292aba0422649f831e18491ec1a267bd11fd945d6621d4315835d3f1fe9f776dfcef5696ecb0c830dce1
SSDEEP

768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezAsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOB3pMC6H

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1956	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1956	1736	rundll32.exe	28
PID 1736 wrote to memory of 1956	1736	rundll32.exe	28
PID 1736 wrote to memory of 1956	1736	rundll32.exe	28
PID 1736 wrote to memory of 1956	1736	rundll32.exe	28
PID 1736 wrote to memory of 1956	1736	rundll32.exe	28
PID 1736 wrote to memory of 1956	1736	rundll32.exe	28
PID 1736 wrote to memory of 1956	1736	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2024df192c38d050f4ccc518a8f74d0c403892fb12a5a4b8d6d62510e7a4846.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2024df192c38d050f4ccc518a8f74d0c403892fb12a5a4b8d6d62510e7a4846.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1956

memory/1956-0-0x0000000075110000-0x0000000075120000-memory.dmp

Filesize
64KB

Download