8fe2fe311c62bba63eb9ce6b06073e719ab348c014f4ba57926224494cbeb1b7

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 00:12

Target

34b8b2ac2079df745a18a92e9b5ccc70N.dll
Size

4.7MB
MD5

34b8b2ac2079df745a18a92e9b5ccc70
SHA1

517dc9bb95d6a8863d676579cf8f6b5bb3aa1f82
SHA256

8fe2fe311c62bba63eb9ce6b06073e719ab348c014f4ba57926224494cbeb1b7
SHA512

066aa31e558117e9fabd3c1f0149eec844e3067a3524635ed02a60cc365aaad6819aaf3df24dc63b0b4068af75d346f2c658dca489ede56f4b93e039feb91a43
SSDEEP

98304:XfKvdjBBRLhaAfvgQHWyQLAFdH8zsgI9ElpG6XVLM/22wBGp68NjriBL3If:vKvdjdL1vxWyQLmdcIzmlpGYoyopRKLK

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2080	rundll32.exe
2080	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2080	2032	rundll32.exe	31
PID 2032 wrote to memory of 2080	2032	rundll32.exe	31
PID 2032 wrote to memory of 2080	2032	rundll32.exe	31
PID 2032 wrote to memory of 2080	2032	rundll32.exe	31
PID 2032 wrote to memory of 2080	2032	rundll32.exe	31
PID 2032 wrote to memory of 2080	2032	rundll32.exe	31
PID 2032 wrote to memory of 2080	2032	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34b8b2ac2079df745a18a92e9b5ccc70N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\34b8b2ac2079df745a18a92e9b5ccc70N.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2080

memory/2080-2-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2080-0-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2080-4-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2080-9-0x0000000073D80000-0x00000000744C8000-memory.dmp

Filesize
7.3MB

Download
memory/2080-12-0x0000000073D80000-0x00000000744C8000-memory.dmp

Filesize
7.3MB

Download
memory/2080-11-0x0000000073D9D000-0x000000007401F000-memory.dmp

Filesize
2.5MB

Download
memory/2080-10-0x0000000073D80000-0x00000000744C8000-memory.dmp

Filesize
7.3MB

Download
memory/2080-7-0x0000000073D9D000-0x000000007401F000-memory.dmp

Filesize
2.5MB

Download