f0d6db2130381b8c73653be56d3a8dc77397d49d7e69ecca9766c8b97c74a313

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 14:17

Target

f0d6db2130381b8c73653be56d3a8dc77397d49d7e69ecca9766c8b97c74a313.dll
Size

108KB
MD5

e9fed99ee79b851dc796e7031eabff95
SHA1

f5e2eda819945e87bec6960e2034da473ccff50b
SHA256

f0d6db2130381b8c73653be56d3a8dc77397d49d7e69ecca9766c8b97c74a313
SHA512

77ca48f1a8d306661cc9236cbbc431603e6bc4ef8020da80e2e1bf65c6dda831e384afebd50e1c588ecaf8ceb183540487f9afc450765956d57f3b7f61d49ff2
SSDEEP

1536:OOxsE9ZQ6UtJnr8k+bU8sq0TCsUeSwQvNudANzDfksWXdC9dlBkUH5A2sKJm:OYKtF8l2qaCsUeJQvNOqvfQSjHe2s

Score

10^/10

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2976 created 1180	2976	rundll32.exe	21

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2976	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2988	2976	rundll32.exe	30
PID 2976 wrote to memory of 2988	2976	rundll32.exe	30
PID 2976 wrote to memory of 2988	2976	rundll32.exe	30
PID 2976 wrote to memory of 2988	2976	rundll32.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1180
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0d6db2130381b8c73653be56d3a8dc77397d49d7e69ecca9766c8b97c74a313.dll,#1
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2976
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2988