4aaf764dae7231f87c74980800826b591581cfab9e47c105149cce4299b44aff

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09/10/2023, 09:28

Target

4aaf764dae7231f87c74980800826b591581cfab9e47c105149cce4299b44aff.dll
Size

262KB
MD5

423de4461178dbb2f57617517a4624b1
SHA1

2660362a651f864a6ac87b1e3d3da8a7d53a2f75
SHA256

4aaf764dae7231f87c74980800826b591581cfab9e47c105149cce4299b44aff
SHA512

24bcc62c3a4f1031e2bafa5100141a78fc7567e609e9831d538ad3b1fd7c8be4402baa332bfd0c2cec417c7cdb4080743619992002f435a1ac1ce0e1a3b3e4de
SSDEEP

6144:dok5Xzs/pg4ZXfxOXxdrAsb7rjvCAOGpm:douZ4FfxsdrfrWIm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2044	1264	rundll32.exe	28
PID 1264 wrote to memory of 2044	1264	rundll32.exe	28
PID 1264 wrote to memory of 2044	1264	rundll32.exe	28
PID 1264 wrote to memory of 2044	1264	rundll32.exe	28
PID 1264 wrote to memory of 2044	1264	rundll32.exe	28
PID 1264 wrote to memory of 2044	1264	rundll32.exe	28
PID 1264 wrote to memory of 2044	1264	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4aaf764dae7231f87c74980800826b591581cfab9e47c105149cce4299b44aff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4aaf764dae7231f87c74980800826b591581cfab9e47c105149cce4299b44aff.dll,#1
  2⤵
  PID:2044