374c1d1ca0fdb46d77ab9dc139fdd77500c9d3cdebb07c39beb9d9d4d00e154b

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
18-09-2023 09:35

Target

374c1d1ca0fdb46d77ab9dc139fdd77500c9d3cdebb07c39beb9d9d4d00e154b.dll
Size

2.0MB
MD5

261dd646d77e7e0c47a9b3bae6c0533e
SHA1

1a0e5b5bade233a7c3410c3aa02af923b7971e2f
SHA256

374c1d1ca0fdb46d77ab9dc139fdd77500c9d3cdebb07c39beb9d9d4d00e154b
SHA512

af38fcffdadd7b764fa40df26f1d3e4428e18968a44e8870092f24561dc1cbf45fe52c1121877717b293682193a2d5fe498c10ab421d585a63a3e33fab4bcd3f
SSDEEP

49152:F0bxVq7+t6rw7AQ9RdWKFlk2Y/gCXPvxzB:F03oi+k9eKFlA1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2172	2168	rundll32.exe	28
PID 2168 wrote to memory of 2172	2168	rundll32.exe	28
PID 2168 wrote to memory of 2172	2168	rundll32.exe	28
PID 2168 wrote to memory of 2172	2168	rundll32.exe	28
PID 2168 wrote to memory of 2172	2168	rundll32.exe	28
PID 2168 wrote to memory of 2172	2168	rundll32.exe	28
PID 2168 wrote to memory of 2172	2168	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\374c1d1ca0fdb46d77ab9dc139fdd77500c9d3cdebb07c39beb9d9d4d00e154b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\374c1d1ca0fdb46d77ab9dc139fdd77500c9d3cdebb07c39beb9d9d4d00e154b.dll,#1
  2⤵
  PID:2172