861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24/08/2023, 10:44

Target

861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll
Size

213KB
MD5

fba481774812fa3c6424bece81f4923d
SHA1

cd93cc0fc436dd9cffda641f62edfd9409c3066d
SHA256

861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e
SHA512

e7c5a659d3e15e53a3247c90175d4c7a8dacffd34a551c090b9c8478f2b9883cde9790e181b7f4cc74a8ce767537111c4cf279a8e0a9ffb9332a44c2aeece9b4
SSDEEP

1536:N8ZkXEMm6jh/3XNPpdpytxr5QSM9JaIbRZmFcPgHrme:PEA3XNItTQSM9JaIbRZmFcPle

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2276	1132	rundll32.exe	28
PID 1132 wrote to memory of 2276	1132	rundll32.exe	28
PID 1132 wrote to memory of 2276	1132	rundll32.exe	28
PID 1132 wrote to memory of 2276	1132	rundll32.exe	28
PID 1132 wrote to memory of 2276	1132	rundll32.exe	28
PID 1132 wrote to memory of 2276	1132	rundll32.exe	28
PID 1132 wrote to memory of 2276	1132	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll,#1
  2⤵
  PID:2276

memory/2276-0-0x0000000000220000-0x000000000025A000-memory.dmp

Filesize
232KB

Download