a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
26-08-2023 14:33

Target

a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll
Size

4.7MB
MD5

331da35d81d042fc2c96b94e10f2ed85
SHA1

938e9754a275e8287da29af1c63a75ba6430ae71
SHA256

a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4
SHA512

0ecc01ea0dd4a6fed974d21d4d2edcee27754c93a632ebf5ad489e58a2326e15a98a3bdb4ed34c74501ccfb789190fb1ca7c2e0612afd24b58c6fe1d62868c11
SSDEEP

98304:/U+9X5+01Y0sC5qNddE+Qu7mwEIvd/uNcOKLMPwO7qa21svhjWUV:hX5+01D5qzdTh3VUWpUFHV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 944	2208	rundll32.exe	28
PID 2208 wrote to memory of 944	2208	rundll32.exe	28
PID 2208 wrote to memory of 944	2208	rundll32.exe	28
PID 2208 wrote to memory of 944	2208	rundll32.exe	28
PID 2208 wrote to memory of 944	2208	rundll32.exe	28
PID 2208 wrote to memory of 944	2208	rundll32.exe	28
PID 2208 wrote to memory of 944	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1
  2⤵
  PID:944