06500a1a2f152b59ceeb662d7bd5bb07175bf45a9c2528b2f6de58394ada4bc5

Analysis

max time kernel
1608s
max time network
1611s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04/06/2023, 18:56

Target

Compiled/Misc/Plugins/DDOS.dll
Size

27KB
MD5

b7cde2f53269635ec102d1f663b1e060
SHA1

53515410defbc8e2c4142ab38132422e602f505a
SHA256

00886577e5077520edfe6b0985309bd83d7218ab594b617eda398a2e7d1420ff
SHA512

a650a5f428255c5ead09a16967ad18b89399156edb92275d6b9d0ee8d8cd30ae13b6a68c970f8d7e12f08e6218f3ba567cc9f809617ff95e919cd14593a749d2
SSDEEP

384:K51up71QhFkr27dnFTK76iaU6/79Lq8wjCKjY6A39eP9eeP3kXsr/MeH9e1jDf/H:Ka7ihRdlK/G/gXLo3Yvka3+L

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1540	1224	rundll32.exe	28
PID 1224 wrote to memory of 1540	1224	rundll32.exe	28
PID 1224 wrote to memory of 1540	1224	rundll32.exe	28
PID 1224 wrote to memory of 1540	1224	rundll32.exe	28
PID 1224 wrote to memory of 1540	1224	rundll32.exe	28
PID 1224 wrote to memory of 1540	1224	rundll32.exe	28
PID 1224 wrote to memory of 1540	1224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Compiled\Misc\Plugins\DDOS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Compiled\Misc\Plugins\DDOS.dll,#1
  2⤵
  PID:1540