9733e3f15efe06bfbf6f1e890eee2f4b550f053acb18be931b1cb1c0c8f004ab

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31-08-2023 02:57

Target

todolist_exe/EncryptDecrypt.dll
Size

48KB
MD5

2f17d64d6f7fba7e7e9750495f926bb6
SHA1

1dce4dbe2a9e4977a85f0451ed92f14e30c1b3e7
SHA256

ca3412fa4113e1aed53100391639e350213dfea4fdfb6a75d8522001d640e5b1
SHA512

0d806a248603b15da98f4e8a2d55a908f4d4d10aab11da81a41985703f59d2de274b6ce8fc2eee47f3f76dbc8b81279567bda6656e084e4e745a3eba1f32c254
SSDEEP

768:SMEpPMoJ7GcIQQ64CuANMqWNU+K74FV2pRpWbSDHCHFAHoiYX:SNZCANMqqU+NV23S2IpX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1604	2496	rundll32.exe	28
PID 2496 wrote to memory of 1604	2496	rundll32.exe	28
PID 2496 wrote to memory of 1604	2496	rundll32.exe	28
PID 2496 wrote to memory of 1604	2496	rundll32.exe	28
PID 2496 wrote to memory of 1604	2496	rundll32.exe	28
PID 2496 wrote to memory of 1604	2496	rundll32.exe	28
PID 2496 wrote to memory of 1604	2496	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\EncryptDecrypt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\EncryptDecrypt.dll,#1
  2⤵
  PID:1604