3b2fe78d8564888111761d553993d2299f2c1d0622a56770508da2bbbb8cbe4e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 01:32

Target

21c01c717d6af608b620c588dc470b70N.dll
Size

484KB
MD5

21c01c717d6af608b620c588dc470b70
SHA1

f1e96ec73e97e0a7ae6271be7229ca26e06fb8df
SHA256

3b2fe78d8564888111761d553993d2299f2c1d0622a56770508da2bbbb8cbe4e
SHA512

f23ba98ecf1120e8fc9656fd5b6c1fbc5cb9e3ff1115173b5844eeb05c381b7bdce2872e45fcdbf911ecaff695953603650d82f927b5d80db7f9ab90c39efdda
SSDEEP

6144:NdAEPni5aBaXMOBpYx3iqJeFH5m/JIFhHOKQO8f1zOMJm:nAzEBJxPeqk9QO8f16MJ

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
2552	rundll32.exe
2552	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2552	3048	rundll32.exe	30
PID 3048 wrote to memory of 2552	3048	rundll32.exe	30
PID 3048 wrote to memory of 2552	3048	rundll32.exe	30
PID 3048 wrote to memory of 2552	3048	rundll32.exe	30
PID 3048 wrote to memory of 2552	3048	rundll32.exe	30
PID 3048 wrote to memory of 2552	3048	rundll32.exe	30
PID 3048 wrote to memory of 2552	3048	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21c01c717d6af608b620c588dc470b70N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21c01c717d6af608b620c588dc470b70N.dll,#1
  2⤵
  - Loads dropped DLL
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\1FEF.tmp
    C:\Users\Admin\AppData\Local\Temp\1FEF.tmp
    3⤵
    PID:1744

\Users\Admin\AppData\Local\Temp\1FEF.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/2552-0-0x00000000002C0000-0x00000000002F5000-memory.dmp

Filesize
212KB

Download