bdb9ac49db1d32914c1913be6744ee91d506ac60d9af22491c4c5719914b9849

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 21:28

Target

SecuriteInfo.com.Trojan.Loader.1535.30614.dll
Size

80KB
MD5

b387e71627d3acf3e0bb18d03c15c681
SHA1

dc9e2929a79e49b494e57e756050d98334e8ba6a
SHA256

bdb9ac49db1d32914c1913be6744ee91d506ac60d9af22491c4c5719914b9849
SHA512

16a9be3d1e945d4a361a89ee7a6c9eeb017c697eafb8f72b3a3297555e8483e5de09837ae697fba35cc1704134705deba5172f41f20c2cae914cb538daf9ebbd
SSDEEP

1536:PylVbbaXZgBNIIoFivWFznJzMqqwRIbD8mCHJI/lsWEcdhUz4/:PyigvIIk7JztWlCahUz4/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1652	1724	rundll32.exe	28
PID 1724 wrote to memory of 1652	1724	rundll32.exe	28
PID 1724 wrote to memory of 1652	1724	rundll32.exe	28
PID 1724 wrote to memory of 1652	1724	rundll32.exe	28
PID 1724 wrote to memory of 1652	1724	rundll32.exe	28
PID 1724 wrote to memory of 1652	1724	rundll32.exe	28
PID 1724 wrote to memory of 1652	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Loader.1535.30614.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Loader.1535.30614.dll,#1
  2⤵
  PID:1652