b28f235193b5b25683877201b4624546fd48185b496e00cbad8b557e7873fc03

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15-10-2023 14:57

Target

96c9eef95cd9351760c8b77d42030680_dll32_JC.dll
Size

844KB
MD5

96c9eef95cd9351760c8b77d42030680
SHA1

747ad3401ec48866a0104f16473b0f526814fc0b
SHA256

b28f235193b5b25683877201b4624546fd48185b496e00cbad8b557e7873fc03
SHA512

d4fe3fb96e35ecb4a7003616b4eab63d751bb77d1f04713034e3af8dea7592ce8428d9efd972012ee5e5691f16699b75c4e67861fad5d678b2cf9a5d184355cf
SSDEEP

12288:4ELphKPYMlxUYfTHHHxBb7PWC+UZ2qm2JWNYdesoYcXPMBIKvWRM/Uevy9YISw:1Tu1JHHHxd6UTJ0zqEPMBfoMJ0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1988	1692	rundll32.exe	28
PID 1692 wrote to memory of 1988	1692	rundll32.exe	28
PID 1692 wrote to memory of 1988	1692	rundll32.exe	28
PID 1692 wrote to memory of 1988	1692	rundll32.exe	28
PID 1692 wrote to memory of 1988	1692	rundll32.exe	28
PID 1692 wrote to memory of 1988	1692	rundll32.exe	28
PID 1692 wrote to memory of 1988	1692	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96c9eef95cd9351760c8b77d42030680_dll32_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96c9eef95cd9351760c8b77d42030680_dll32_JC.dll,#1
  2⤵
  PID:1988