53affb714e415454812ab19b140ec5efe884d2751485f36230a3cc732da82eae

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
23/11/2023, 12:02

Target

53affb714e415454812ab19b140ec5efe884d2751485f36230a3cc732da82eae.dll
Size

2.2MB
MD5

e09093e2a3b3139f9e9c03491f5117f6
SHA1

576dc2976b8f2a4911e915c310f0dde1e172c78d
SHA256

53affb714e415454812ab19b140ec5efe884d2751485f36230a3cc732da82eae
SHA512

cb76e0b625de4f78d4582e7c079156a1382d819458b7d9963036d1e4604727b10930c21949a35507cd6a8509ff3955991b1ecb5f56c91f015e9c22a516bde1f4
SSDEEP

49152:TJd0OM5Fym/8RgJ1YM97tQjFozL19wNa/Wgq:VCOM5WyJ4jFKp9JWgq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2032	3048	rundll32.exe	28
PID 3048 wrote to memory of 2032	3048	rundll32.exe	28
PID 3048 wrote to memory of 2032	3048	rundll32.exe	28
PID 3048 wrote to memory of 2032	3048	rundll32.exe	28
PID 3048 wrote to memory of 2032	3048	rundll32.exe	28
PID 3048 wrote to memory of 2032	3048	rundll32.exe	28
PID 3048 wrote to memory of 2032	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53affb714e415454812ab19b140ec5efe884d2751485f36230a3cc732da82eae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\53affb714e415454812ab19b140ec5efe884d2751485f36230a3cc732da82eae.dll,#1
  2⤵
  PID:2032