68ce8c2149b4eab7e6a8aea2c101b414d9ad64b6f2b6ad2c44ae2a61d36725f8

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22/07/2023, 15:28

Target

irrKlang.NET4.dll
Size

490KB
MD5

ac0b6db031b4d88249f08d3650be9689
SHA1

cc54333d6bea758aac973eb2fdcb89c15ba20611
SHA256

c8bc680a6d599d7981d7566118d3d8195aa8dd66fdd9419e1869adbeb1132e05
SHA512

085f09580c2b0186d252838865a059b019dbf806c85b2ec78969cd568a0aa11518c9d91f6392f345c270a05617457c37042d24083e973fe7c09bdc33d2797b9b
SSDEEP

6144:4rZDB3AZ7yTNXDD4mQs19LbBXVtNF7R+E84F7IXo+ApnNKGekmnjOfY8R0G62B:4rZmINXP4mQs3184hI43pNKGekvO2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2404	2384	rundll32.exe	28
PID 2384 wrote to memory of 2404	2384	rundll32.exe	28
PID 2384 wrote to memory of 2404	2384	rundll32.exe	28
PID 2384 wrote to memory of 2404	2384	rundll32.exe	28
PID 2384 wrote to memory of 2404	2384	rundll32.exe	28
PID 2384 wrote to memory of 2404	2384	rundll32.exe	28
PID 2384 wrote to memory of 2404	2384	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\irrKlang.NET4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\irrKlang.NET4.dll,#1
  2⤵
  PID:2404