14aa67b289452fbb68197a676f9a291aae35cd72c3bc7b425e7c42645aac6d65

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 02:45

Target
lz0xkoqy.dll
Size 11KB
Sample240713-c83qlascrn
SHA256 de757495d61e622adffed7588acdb5eba2f18734c13eaf9e25949779f2cb75fe
MD5 1dc8118acd04962a04f537c7dabe17be
SHA1 c04648b207433324803c595b22efaafc2423bfd3
SHA512 54107302bff8bfe9179f969f13045f83281ae9aef8ab2e723f0aa540fc46dc86d2a23b79ecfd6700b2fedbf3cf729a0693887bbad772fa993a5a7ee8bb9c0475
SSDEEP 192:IRkq0eddH2mOTFM6tlPFfYamGaGQITKzWAg8CRuDqxz6:QkS8FMOl9g0aZITQ6R5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 376	2108	rundll32.exe	30
PID 2108 wrote to memory of 376	2108	rundll32.exe	30
PID 2108 wrote to memory of 376	2108	rundll32.exe	30
PID 2108 wrote to memory of 376	2108	rundll32.exe	30
PID 2108 wrote to memory of 376	2108	rundll32.exe	30
PID 2108 wrote to memory of 376	2108	rundll32.exe	30
PID 2108 wrote to memory of 376	2108	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lz0xkoqy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lz0xkoqy.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376

memory/376-0-0x0000000010000000-0x0000000010006000-memory.dmp

Download