5d2cce0985a00ccc22dc5b6b0eb57d8a1f93a5878ac6f88e61574517295006ff

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 15:20

Target

f3815194ea890103970d5e92867d7350_dll32_JC.dll
Size

144KB
MD5

f3815194ea890103970d5e92867d7350
SHA1

6305937147283a530b2963f3074313e4d784242b
SHA256

5d2cce0985a00ccc22dc5b6b0eb57d8a1f93a5878ac6f88e61574517295006ff
SHA512

aa4ff4f2f96d8f560f0010fa72c50eb6504adbbb54557bf6d5f2e07e9740c306287a2c21b6fbefa673d65dcc1379220354a7b74cd31f76d403611c60521529ac
SSDEEP

1536:Y38ebGiH3WwzXq2LaR0F5gulnbkaGwOpDtrlQylYj77C6S3NtMSnU9TB:clGiq6aCnizuG6S3NtMyUx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2296	2144	rundll32.exe	28
PID 2144 wrote to memory of 2296	2144	rundll32.exe	28
PID 2144 wrote to memory of 2296	2144	rundll32.exe	28
PID 2144 wrote to memory of 2296	2144	rundll32.exe	28
PID 2144 wrote to memory of 2296	2144	rundll32.exe	28
PID 2144 wrote to memory of 2296	2144	rundll32.exe	28
PID 2144 wrote to memory of 2296	2144	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3815194ea890103970d5e92867d7350_dll32_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3815194ea890103970d5e92867d7350_dll32_JC.dll,#1
  2⤵
  PID:2296