61cfccee94629c25d51fb82b8863cbd64c0686088d70f5e96a90c966b2d5f2bd

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/08/2023, 10:33

Target

61cfccee94629c25d51fb82b8863cbd64c0686088d70f5e96a90c966b2d5f2bd.dll
Size

21KB
MD5

a228dd7b5580f5658aff0c17aa6a00a4
SHA1

c5c36ad9c69d59088ca734acc0d18e15bc9a4c60
SHA256

61cfccee94629c25d51fb82b8863cbd64c0686088d70f5e96a90c966b2d5f2bd
SHA512

8f8aeedd4952002766c1e4eb97089601fb3ce945354b0faedf3873037a21ba16c1479eb19e59a40e3400f0d98433792c593152915a16eb60761fc6519113f94e
SSDEEP

384:bjljXOurWoWE9Q9y735Y33e4iUXwDLQ6E:bjljXOuyoVkMY33ecwnQb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 940	1376	rundll32.exe	29
PID 1376 wrote to memory of 940	1376	rundll32.exe	29
PID 1376 wrote to memory of 940	1376	rundll32.exe	29
PID 1376 wrote to memory of 940	1376	rundll32.exe	29
PID 1376 wrote to memory of 940	1376	rundll32.exe	29
PID 1376 wrote to memory of 940	1376	rundll32.exe	29
PID 1376 wrote to memory of 940	1376	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61cfccee94629c25d51fb82b8863cbd64c0686088d70f5e96a90c966b2d5f2bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61cfccee94629c25d51fb82b8863cbd64c0686088d70f5e96a90c966b2d5f2bd.dll,#1
  2⤵
  PID:940