6a67e05969f04dd8fe1bd622f7119acf118edfb57276b7eea17f5613e4325c38

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/03/2023, 22:38

Target

UsNZh.dll
Size

318KB
MD5

be07246414f007b836fca7dc36958aa5
SHA1

ddc327192d26d9152c4fe1268a8c75e504c57600
SHA256

6a67e05969f04dd8fe1bd622f7119acf118edfb57276b7eea17f5613e4325c38
SHA512

518c285bf4a2ab0595df705f534207d4008b33f907766ecc1b86f00c20229de1221f28c62314e22f2907f09e3d6f19b351f5528c54d7141bfacd9c9f9e2a2adc
SSDEEP

6144:NaaVzaA4R+aU/P/IvTDp3ZZ99GSrtMhsNW9TUW/aSFGMReiDhKRIbGjZneB6ncqp:m+aU/P/IvTDp3ZZ99RrtyU2GSYIajfnz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1120	1048	rundll32.exe	27
PID 1048 wrote to memory of 1120	1048	rundll32.exe	27
PID 1048 wrote to memory of 1120	1048	rundll32.exe	27
PID 1048 wrote to memory of 1120	1048	rundll32.exe	27
PID 1048 wrote to memory of 1120	1048	rundll32.exe	27
PID 1048 wrote to memory of 1120	1048	rundll32.exe	27
PID 1048 wrote to memory of 1120	1048	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UsNZh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\UsNZh.dll,#1
  2⤵
  PID:1120