41cef4bb46a138cc088ebe7be2441fcab67c1e91d0808eafc49e9e7c20a2dffe

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 15:05

Target

b1ad7407203c2c49bfe6e7ccba7b7380_dll32_JC.dll
Size

6KB
MD5

b1ad7407203c2c49bfe6e7ccba7b7380
SHA1

c652eefa9f2ca13ad37ea50817f63dbf7c4ffada
SHA256

41cef4bb46a138cc088ebe7be2441fcab67c1e91d0808eafc49e9e7c20a2dffe
SHA512

6de8cfb637eac6794d0041c0939171d491c24cb900eb1c1b184cc818ae9ed41a6051f772f27eee2dae40010cf3667c194688090c12f88c7266ceb6cd4899e97c
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU10UB+BDq9J5SV3DY:CSVVEPozmB7WB+FqX5S1D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 2788	740	rundll32.exe	28
PID 740 wrote to memory of 2788	740	rundll32.exe	28
PID 740 wrote to memory of 2788	740	rundll32.exe	28
PID 740 wrote to memory of 2788	740	rundll32.exe	28
PID 740 wrote to memory of 2788	740	rundll32.exe	28
PID 740 wrote to memory of 2788	740	rundll32.exe	28
PID 740 wrote to memory of 2788	740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1ad7407203c2c49bfe6e7ccba7b7380_dll32_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1ad7407203c2c49bfe6e7ccba7b7380_dll32_JC.dll,#1
  2⤵
  PID:2788