f0d6db2130381b8c73653be56d3a8dc77397d49d7e69ecca9766c8b97c74a313

Analysis

max time kernel
95s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 14:17

Target

f0d6db2130381b8c73653be56d3a8dc77397d49d7e69ecca9766c8b97c74a313.dll
Size

108KB
MD5

e9fed99ee79b851dc796e7031eabff95
SHA1

f5e2eda819945e87bec6960e2034da473ccff50b
SHA256

f0d6db2130381b8c73653be56d3a8dc77397d49d7e69ecca9766c8b97c74a313
SHA512

77ca48f1a8d306661cc9236cbbc431603e6bc4ef8020da80e2e1bf65c6dda831e384afebd50e1c588ecaf8ceb183540487f9afc450765956d57f3b7f61d49ff2
SSDEEP

1536:OOxsE9ZQ6UtJnr8k+bU8sq0TCsUeSwQvNudANzDfksWXdC9dlBkUH5A2sKJm:OYKtF8l2qaCsUeJQvNOqvfQSjHe2s

Score

10^/10

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3924 created 3428	3924	rundll32.exe	56

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3924	rundll32.exe
3924	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 1300	3924	rundll32.exe	83
PID 3924 wrote to memory of 1300	3924	rundll32.exe	83
PID 3924 wrote to memory of 1300	3924	rundll32.exe	83

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3428
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0d6db2130381b8c73653be56d3a8dc77397d49d7e69ecca9766c8b97c74a313.dll,#1
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3924
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1300