0da742bf2f9fc109299f94f31782b888b48dafdca54c1c148e2db67957609609

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
27/06/2023, 19:58

Target

0da742bf2f9fc109299f94f31782b888b48dafdca54c1c148e2db67957609609.dll
Size

332KB
MD5

d8a1f372079f7d97b84dd65b335f0a72
SHA1

5441dad766515ded3881351326ee7c712a1196b8
SHA256

0da742bf2f9fc109299f94f31782b888b48dafdca54c1c148e2db67957609609
SHA512

ed42f4fc57fb03dda839f3b1ecf9c45be47b472fc73d6470df1f5d98459c4d5ee34bca7643e9ecf3419a1240a9ea619bd1851443614cf23571480a4f2f1c4c7a
SSDEEP

6144:a+Jh/N7cdkYY2AQv94j6ep98lpTOhShmsVRiWEj5s:dh/Fcd/YP89U98lpT7B9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1672	1200	rundll32.exe	27
PID 1200 wrote to memory of 1672	1200	rundll32.exe	27
PID 1200 wrote to memory of 1672	1200	rundll32.exe	27
PID 1200 wrote to memory of 1672	1200	rundll32.exe	27
PID 1200 wrote to memory of 1672	1200	rundll32.exe	27
PID 1200 wrote to memory of 1672	1200	rundll32.exe	27
PID 1200 wrote to memory of 1672	1200	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0da742bf2f9fc109299f94f31782b888b48dafdca54c1c148e2db67957609609.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0da742bf2f9fc109299f94f31782b888b48dafdca54c1c148e2db67957609609.dll,#1
  2⤵
  PID:1672