28bb09aa9c53b5af3f0846c3c1f8e3c6b60918504ef74a678b89ffbd3bc1a9b0

Analysis

max time kernel
12s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 08:14

Target

28bb09aa9c53b5af3f0846c3c1f8e3c6b60918504ef74a678b89ffbd3bc1a9b0.dll
Size

3.5MB
MD5

bbda1e7d5a28dfac6f028aaee8ca5579
SHA1

27fb9fcc6ef076dbf7dd224a257efa4257343dc4
SHA256

28bb09aa9c53b5af3f0846c3c1f8e3c6b60918504ef74a678b89ffbd3bc1a9b0
SHA512

f5baeb4f29664b8177e8a1c85842902c64b2ff3987ecf4ab43b2717365c6eb41b17b62b3f71b14031cdfaaec262b4e40f5d853b36ab319a19722d75e0c8e16e2
SSDEEP

49152:WwApIj2UwOmhJfOkNqZbPxrH4jP/A7+Lc37acfmWd/5gPzpuOEeMzj+TALICmwdf:Wrmj3EA6qNJ7F7yTWnRYEeMzj7BxMxk

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1120	rundll32.exe
1120	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28bb09aa9c53b5af3f0846c3c1f8e3c6b60918504ef74a678b89ffbd3bc1a9b0.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1120

memory/1120-5-0x000007FEF50E0000-0x000007FEF567D000-memory.dmp

Filesize
5.6MB

Download
memory/1120-6-0x000007FEF5103000-0x000007FEF52FF000-memory.dmp

Filesize
2.0MB

Download
memory/1120-4-0x0000000076FC0000-0x0000000076FC2000-memory.dmp

Filesize
8KB

Download
memory/1120-2-0x0000000076FC0000-0x0000000076FC2000-memory.dmp

Filesize
8KB

Download
memory/1120-0-0x0000000076FC0000-0x0000000076FC2000-memory.dmp

Filesize
8KB

Download