ab2024dcc15172d845346a61617d3b6ce556d88846e3c62ed4606235ce85f20b

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
04-07-2023 20:20

Target

challange_Benign_ab2024dcc15172d845346a61617d3b6ce556d88846e3c62ed4606235ce85f20b.dll
Size

54KB
MD5

884b932d41cf23c914339fc841d634b4
SHA1

7f0c6934ff0e10581c58dcd7d8ba5466f4bbca1f
SHA256

ab2024dcc15172d845346a61617d3b6ce556d88846e3c62ed4606235ce85f20b
SHA512

74e4708d4b9c4d920d5cd51510b2a89d5d75038261fa090bc3df40ff033947bfa008e5ba88353a15cd806b4122dd5ca6fc440c3a497d03b962d3369bf8d0d636
SSDEEP

768:hc+WPdsPKtU5uzc0WgdNpdSNqhHpNSpKV6B6sGOkidD1Er0S624d1SPdZZ2:h+PAcuur1zeGSPB6sGOkid+B62TVZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1284	1764	rundll32.exe	27
PID 1764 wrote to memory of 1284	1764	rundll32.exe	27
PID 1764 wrote to memory of 1284	1764	rundll32.exe	27
PID 1764 wrote to memory of 1284	1764	rundll32.exe	27
PID 1764 wrote to memory of 1284	1764	rundll32.exe	27
PID 1764 wrote to memory of 1284	1764	rundll32.exe	27
PID 1764 wrote to memory of 1284	1764	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\challange_Benign_ab2024dcc15172d845346a61617d3b6ce556d88846e3c62ed4606235ce85f20b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\challange_Benign_ab2024dcc15172d845346a61617d3b6ce556d88846e3c62ed4606235ce85f20b.dll,#1
  2⤵
  PID:1284

memory/1284-54-0x0000000074DD0000-0x0000000074DEA000-memory.dmp

Filesize
104KB

Download
memory/1284-55-0x0000000074DB0000-0x0000000074DCA000-memory.dmp

Filesize
104KB

Download
memory/1284-56-0x00000000000C0000-0x00000000000C3000-memory.dmp

Filesize
12KB

Download
memory/1284-58-0x0000000074DD0000-0x0000000074DE3000-memory.dmp

Filesize
76KB

Download