f9113b6cf705d399ab6f394d7df4b26301909f48f2230b93cc7c9a0dae0600e2

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 02:22

Target

f4d69acc82de86db59ff733d7c4504240b8bc8988e3d8593ce674415f0db74b7.dll
Size

108KB
MD5

8893047b15405b20a39afbb8f9cc4d1e
SHA1

6c84262903cadb218bfc16e1784af86ed32ff9bd
SHA256

f4d69acc82de86db59ff733d7c4504240b8bc8988e3d8593ce674415f0db74b7
SHA512

949ebf6d501d7dc5214ff838498c146c97f3160c9097846f2706904ec00b7ebbaadae9356c2a520d082f00b04c96fe6235d189eb0cac59e4b639426b7e8d2d50
SSDEEP

1536:o0phaPh6KMG2KCB+Cjn1mz2FrTG8+2olmnlguqiPltGcWAKtQs3NX:lzvl11OkJ1XWAKtQs3N

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2528	rundll32.exe
2528	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4d69acc82de86db59ff733d7c4504240b8bc8988e3d8593ce674415f0db74b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4d69acc82de86db59ff733d7c4504240b8bc8988e3d8593ce674415f0db74b7.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2528