60b488d9eee99f8d9777ea7e0db9ce0cec491554df4ebb51245a5662a9042e3e

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19/09/2023, 01:16

Target

60b488d9eee99f8d9777ea7e0db9ce0cec491554df4ebb51245a5662a9042e3e.dll
Size

4KB
MD5

622a988d72310ed5afc692308304172e
SHA1

ecc67a8db0a91418a1a8c5c41010a5d678b18094
SHA256

60b488d9eee99f8d9777ea7e0db9ce0cec491554df4ebb51245a5662a9042e3e
SHA512

c30cbe81c6e226fce883d1c0babfe5f340f8cc8fc4c89fa0e44b131e70ed52d7db64ba566f9b752af9cdc1088344e12a7e8fb9453f11fae23b33409322627e42
SSDEEP

24:ZFGStQQVGkfFzVzTRcJzFD2E4GssNhvfHBmmdNIPNZT:Zdt5AkfFBzTKss7HBmmnwZT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2992	2812	rundll32.exe	28
PID 2812 wrote to memory of 2992	2812	rundll32.exe	28
PID 2812 wrote to memory of 2992	2812	rundll32.exe	28
PID 2812 wrote to memory of 2992	2812	rundll32.exe	28
PID 2812 wrote to memory of 2992	2812	rundll32.exe	28
PID 2812 wrote to memory of 2992	2812	rundll32.exe	28
PID 2812 wrote to memory of 2992	2812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60b488d9eee99f8d9777ea7e0db9ce0cec491554df4ebb51245a5662a9042e3e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60b488d9eee99f8d9777ea7e0db9ce0cec491554df4ebb51245a5662a9042e3e.dll,#1
  2⤵
  PID:2992