48ec0493ff1d4f53dfcd19e7d50bc7a8f049ba949ce46d0b3990b6046ebbd459

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/09/2023, 18:39

Target

48ec0493ff1d4f53dfcd19e7d50bc7a8f049ba949ce46d0b3990b6046ebbd459.dll
Size

2.0MB
MD5

babb12a3f7a67887aab0b8edbffb3515
SHA1

46671de9fc94e835ff62211a76792a503b259351
SHA256

48ec0493ff1d4f53dfcd19e7d50bc7a8f049ba949ce46d0b3990b6046ebbd459
SHA512

b27de082919ce1b14c354b5004a073028a9f012e9ab42a6ad00c6805c4302c24539a1fdae2da961be10eca7bbf8d0bfaca3b7917ce752c1f5f0be4fe3b1acf7c
SSDEEP

49152:F0bxVqHwt6rw7AQ9RdaKFlk2Y/gCXPvxz2:F03sI+k9yKFlAy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2260	2372	rundll32.exe	28
PID 2372 wrote to memory of 2260	2372	rundll32.exe	28
PID 2372 wrote to memory of 2260	2372	rundll32.exe	28
PID 2372 wrote to memory of 2260	2372	rundll32.exe	28
PID 2372 wrote to memory of 2260	2372	rundll32.exe	28
PID 2372 wrote to memory of 2260	2372	rundll32.exe	28
PID 2372 wrote to memory of 2260	2372	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48ec0493ff1d4f53dfcd19e7d50bc7a8f049ba949ce46d0b3990b6046ebbd459.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48ec0493ff1d4f53dfcd19e7d50bc7a8f049ba949ce46d0b3990b6046ebbd459.dll,#1
  2⤵
  PID:2260