f034640560565580e9233100f97d3e6a594915bd7d900cff444fd1c2c48c2cc0

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 17:03

Target

$TEMP/Dump.dll
Size

292KB
MD5

eccc601de1be530ab586f67a7746a1d7
SHA1

2fe1eb70c44e9bfe7f7b989501d397e2ab0af94e
SHA256

7b8ddc02606124e198e8c333d0e39a1f7c5d8233b42db42352206bde59178319
SHA512

0fa9044aa44532949a2009cc37ced65c1c75a56619680a95ac53c9bdcc7c61d7d874bb3f01e1c62987a6c777f2008a5a9a7605d8fd327010ededcdad874a94e4
SSDEEP

3072:BvQSSX/jiSHqVM0bwTAxwYpjdk233cHtqOCnXayRa9L7IC4NYZ+o8MpFBPG5SJ+D:BvnSX/jfaw0xbG2ncHkXbg+0t8D

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FunshionService.diagnose	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1716	1712	rundll32.exe	30
PID 1712 wrote to memory of 1716	1712	rundll32.exe	30
PID 1712 wrote to memory of 1716	1712	rundll32.exe	30
PID 1712 wrote to memory of 1716	1712	rundll32.exe	30
PID 1712 wrote to memory of 1716	1712	rundll32.exe	30
PID 1712 wrote to memory of 1716	1712	rundll32.exe	30
PID 1712 wrote to memory of 1716	1712	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\Dump.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\Dump.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:1716