143e56f0eb490729db24fc99e8fbafac53acef8517e17b063b211416910fc9ef

Analysis

max time kernel
4s
max time network
3s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/08/2023, 04:39

Target

C.dll
Size

4.2MB
MD5

ef2a78c97ba90e8429c3d1d37c179d33
SHA1

8ded75e609b1817f59b1c4f0c8a4397da49574c1
SHA256

143e56f0eb490729db24fc99e8fbafac53acef8517e17b063b211416910fc9ef
SHA512

1111d4b602871b264d0995673b1f27553d90f0bfb40d48d33bd21143e117a028fbb472b0120a7e05c5a6a5109b7a8b5634fddde90623aee7781db6244fd6f288
SSDEEP

98304:4HNh7Gv1vZCx2mkZxKRJz1UMMKLZNzhO5Cs:4HNsv1xmkZcRJxNLZNzC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1968	1988	rundll32.exe	28
PID 1988 wrote to memory of 1968	1988	rundll32.exe	28
PID 1988 wrote to memory of 1968	1988	rundll32.exe	28
PID 1988 wrote to memory of 1968	1988	rundll32.exe	28
PID 1988 wrote to memory of 1968	1988	rundll32.exe	28
PID 1988 wrote to memory of 1968	1988	rundll32.exe	28
PID 1988 wrote to memory of 1968	1988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\C.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\C.dll,#1
  2⤵
  PID:1968
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic cpu get processorid
    3⤵
    PID:2340

memory/1968-54-0x0000000073D80000-0x00000000747DE000-memory.dmp

Filesize
10.4MB

Download
memory/1968-55-0x0000000072E70000-0x00000000738CE000-memory.dmp

Filesize
10.4MB

Download
memory/1968-57-0x0000000073D80000-0x00000000747DE000-memory.dmp

Filesize
10.4MB

Download
memory/1968-56-0x0000000072E70000-0x00000000738CE000-memory.dmp

Filesize
10.4MB

Download
memory/1968-59-0x0000000072E70000-0x00000000738CE000-memory.dmp

Filesize
10.4MB

Download
memory/1968-60-0x0000000072E70000-0x00000000738CE000-memory.dmp

Filesize
10.4MB

Download
memory/1968-61-0x0000000010000000-0x0000000010180000-memory.dmp

Filesize
1.5MB

Download