71af3b1eb3b6593a5c01b0582c07a8ba6d92a780d1c0b9ef02bea1ad008d98ee

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 08:35

Target

nwl415x2fc-cleaned.dll
Size

260KB
MD5

7946926dd10e953e5056515a20954a73
SHA1

6090eec59234bd0237abef6b222329b7739b2e43
SHA256

71af3b1eb3b6593a5c01b0582c07a8ba6d92a780d1c0b9ef02bea1ad008d98ee
SHA512

823c2f6c7d0ab55dc72c70feee9776c0a1cac60d74aaa12e13fc173ba58847ae8439af76dfd2a9ddbadd2091ad658200ce36a119d4ae1ae5124e1e435ff3a912
SSDEEP

3072:0TBncFWn1GG7bnDOlQGJ1axJO3d0NBMFh3wXrnWm6ObcgOXyMZbv4uEnk0ZOuK9V:0TpGG7jtO3dmuhAXr9bLOXXZbgp1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2064	1196	rundll32.exe	28
PID 1196 wrote to memory of 2064	1196	rundll32.exe	28
PID 1196 wrote to memory of 2064	1196	rundll32.exe	28
PID 1196 wrote to memory of 2064	1196	rundll32.exe	28
PID 1196 wrote to memory of 2064	1196	rundll32.exe	28
PID 1196 wrote to memory of 2064	1196	rundll32.exe	28
PID 1196 wrote to memory of 2064	1196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nwl415x2fc-cleaned.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\nwl415x2fc-cleaned.dll,#1
  2⤵
  PID:2064