3095df5dccbf2e5b7f794ec7a4616976988316d0dd11840f0a31998df82ed3af

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
03-07-2023 04:30

Target

SecuriteInfo.com.Variant.Tedy.391406.4242.20080.dll
Size

22KB
MD5

6dae04bbc70af890959232841e5bddc9
SHA1

62250b05d50d3c573f16aa0411ae5293bd03ffa0
SHA256

3095df5dccbf2e5b7f794ec7a4616976988316d0dd11840f0a31998df82ed3af
SHA512

6d35fc45827b6164ba7e61496ce241cd209a2b914373d049cc72e427dca33ff7d74ccce90b934899447e7a1e361a92640a21977964e038c9116a8e9d4564fc77
SSDEEP

192:eBLkIAXmchPhQc+Q8t4+gaECeZJaJewLRsutxFBXgGW8fEvMCALnN7kNt/E/whWH:62lmEWsuPXjW8fPNQfEPoDCSdZBM3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1192	1304	rundll32.exe	27
PID 1304 wrote to memory of 1192	1304	rundll32.exe	27
PID 1304 wrote to memory of 1192	1304	rundll32.exe	27
PID 1304 wrote to memory of 1192	1304	rundll32.exe	27
PID 1304 wrote to memory of 1192	1304	rundll32.exe	27
PID 1304 wrote to memory of 1192	1304	rundll32.exe	27
PID 1304 wrote to memory of 1192	1304	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.391406.4242.20080.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.391406.4242.20080.dll,#1
  2⤵
  PID:1192