5b90443f728e3f8227e5b86b99af755092d6574452b1225b39045062ff1226a4

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24/11/2023, 13:12

Target

5b90443f728e3f8227e5b86b99af755092d6574452b1225b39045062ff1226a4.dll
Size

2.2MB
MD5

907bfb6491861122a30f3747bfb9df24
SHA1

40c9e6139a075327cb4790aa4ebae51272bd54b4
SHA256

5b90443f728e3f8227e5b86b99af755092d6574452b1225b39045062ff1226a4
SHA512

7f3c5f80642805428718cae72e10205870daaee5c41d37e5b759938a2679e0bed565fce25d6e3651d6a3c04fd055bd5dcc6cadbc1bda589082bb29c716095cab
SSDEEP

49152:TJd0Oe5Fym/8RgJfYM97tQjFozL19wNa/Wg1:VCOe56yJOjFKp9JWg1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2908	2568	rundll32.exe	28
PID 2568 wrote to memory of 2908	2568	rundll32.exe	28
PID 2568 wrote to memory of 2908	2568	rundll32.exe	28
PID 2568 wrote to memory of 2908	2568	rundll32.exe	28
PID 2568 wrote to memory of 2908	2568	rundll32.exe	28
PID 2568 wrote to memory of 2908	2568	rundll32.exe	28
PID 2568 wrote to memory of 2908	2568	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b90443f728e3f8227e5b86b99af755092d6574452b1225b39045062ff1226a4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b90443f728e3f8227e5b86b99af755092d6574452b1225b39045062ff1226a4.dll,#1
  2⤵
  PID:2908