f4d72516e3e60d2cd3a103c227be0dd923578e932bec9121b6d134d96b4d0984

Analysis

max time kernel
121s
max time network
140s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:11

Target

Programs/Imager/adencrypt.dll
Size

338KB
MD5

66c926dc17a36fbdffb2e735f1f97f5a
SHA1

65fcedaa9584c138dfa338a1b01d48e6a8963eb1
SHA256

978bd26d3e8fbf4dd7bee11abaa93b1793565888b77b90c844468189d18bd44b
SHA512

81f7273e8f3d5d2a6d20693f4737c34166792fd41d12501640dff6c308c3807b8df43ae0263f1210d0651cf8eff061db7029e81c5530426470d6c1b333e927b2
SSDEEP

6144:l4GGeA4WeFzmvajO5kQfQkNowsYACQJlMDWJ3vkuZrOKJLsYBq:l84/FzmvajO5Lf6wbvrDWJ3vZ8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 3012	2676	rundll32.exe	28
PID 2676 wrote to memory of 3012	2676	rundll32.exe	28
PID 2676 wrote to memory of 3012	2676	rundll32.exe	28
PID 2676 wrote to memory of 3012	2676	rundll32.exe	28
PID 2676 wrote to memory of 3012	2676	rundll32.exe	28
PID 2676 wrote to memory of 3012	2676	rundll32.exe	28
PID 2676 wrote to memory of 3012	2676	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Programs\Imager\adencrypt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Programs\Imager\adencrypt.dll,#1
  2⤵
  PID:3012

memory/3012-0-0x0000000000110000-0x000000000011E000-memory.dmp

Filesize
56KB

Download
memory/3012-2-0x0000000000920000-0x0000000000A1F000-memory.dmp

Filesize
1020KB

Download