e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 13:05

Target

e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce.dll
Size

240KB
MD5

0415a495afb5e811881209cce7d496aa
SHA1

2cfa5822ce6607acc558091d8ea8b4344f12f72a
SHA256

e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce
SHA512

7974d4d445bbbf067c9fd4756e61fad84eb3342ee5625e685d583108bc12511bda3af2e60f479a613997f1dcc922841bfa192b9184b5367c3f3fc537e19f7e62
SSDEEP

3072:/Cc5B9t5RVp8r+n8thbxaCPmldQDzdjIs9OThDGpzioMQDk0496Z:qc5B9hc9hoamOdjkmkm

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\GRGDTATM_CommCfg.ini	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1440	984	rundll32.exe	30
PID 984 wrote to memory of 1440	984	rundll32.exe	30
PID 984 wrote to memory of 1440	984	rundll32.exe	30
PID 984 wrote to memory of 1440	984	rundll32.exe	30
PID 984 wrote to memory of 1440	984	rundll32.exe	30
PID 984 wrote to memory of 1440	984	rundll32.exe	30
PID 984 wrote to memory of 1440	984	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:1440