06500a1a2f152b59ceeb662d7bd5bb07175bf45a9c2528b2f6de58394ada4bc5

Analysis

max time kernel
1603s
max time network
1606s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04/06/2023, 18:56

Target

Compiled/Misc/Plugins/DEC.dll
Size

30KB
MD5

ad10614fb09ced13886362cc9e3f7c93
SHA1

a0bd8a13ace102241556be52dbcd976ce48789dc
SHA256

4be92e8325e7a2f13460d909315e74da3cc5ee4a1ae5efd4499efada064d9d00
SHA512

f8778f4e94bee9785f96300dd7d0be780340198eb2753a5235576a0febd64bd4b442acfabd0f8217df8b0927b7ef8c04f234c997ccc0733b21ea0d550484e7ff
SSDEEP

384:40p87UhKpfHz4dIue9F3z5txSP5KgK21vF161y3du3ee7vpuP6R8aaUXyASLMegc:V84KpfT4refjx4KCtekbaPxC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2032	1692	rundll32.exe	28
PID 1692 wrote to memory of 2032	1692	rundll32.exe	28
PID 1692 wrote to memory of 2032	1692	rundll32.exe	28
PID 1692 wrote to memory of 2032	1692	rundll32.exe	28
PID 1692 wrote to memory of 2032	1692	rundll32.exe	28
PID 1692 wrote to memory of 2032	1692	rundll32.exe	28
PID 1692 wrote to memory of 2032	1692	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Compiled\Misc\Plugins\DEC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Compiled\Misc\Plugins\DEC.dll,#1
  2⤵
  PID:2032