2cf939e53432eac17fea2da63307c87b09ac363ba1d00fb12cd8b90382e47145

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-03-2023 05:14

Target

2cf939e53432eac17fea2da63307c87b09ac363ba1d00fb12cd8b90382e47145.dll
Size

1.1MB
MD5

f21986c00a0be63b3eee5820fbdd2516
SHA1

31ea905e7e3142d20bb5ac69566189b7fba22a09
SHA256

2cf939e53432eac17fea2da63307c87b09ac363ba1d00fb12cd8b90382e47145
SHA512

b992bf6bc0f911d33ffdaf96deaeff82b191e0092cee25e09d9c5b3efb189c94c38d7f54fe26ff4ad604d61f13ff18748cdd5103602b29a2ebb8911bb8fd47c5
SSDEEP

24576:07WuHmDZj4cZ63+S+QSQPUtp8aM8t3W5pzvwalH4yu1I:oWuHmp76GJQPUtpJMyEpqe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1240 wrote to memory of 1616	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1616	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1616	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1616	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1616	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1616	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1616	1240	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cf939e53432eac17fea2da63307c87b09ac363ba1d00fb12cd8b90382e47145.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cf939e53432eac17fea2da63307c87b09ac363ba1d00fb12cd8b90382e47145.dll,#1
2⤵
PID:1616

memory/1616-54-0x0000000010000000-0x00000000101FA000-memory.dmp

Filesize
2.0MB

Download