e31f5f713c038e716e1667a5b883be86ceade68edd63bfd674b4d2af9c83e6c4

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/12/2023, 10:44

Target

0ba365fe646db6779a4ffc9c16b3bde7.dll
Size

13KB
MD5

0ba365fe646db6779a4ffc9c16b3bde7
SHA1

d9d09dd582fd9bcd51a7d113c1ae75065bfe1965
SHA256

e31f5f713c038e716e1667a5b883be86ceade68edd63bfd674b4d2af9c83e6c4
SHA512

607b14fa84a56854efa02310faf9ea6abbe4c84bc243a87150ad29e234f547dd059d9d1f6000bd7dc4daf584d6317bfb478e3482fe321d72b3eebb9a479007d8
SSDEEP

192:/ixmIS9q0EgWwys9gUi+DoioSMBA/bDPGZ7tOdKgIG5tV3X6ThEw9:/igvq0Exa9I+noSMwbDPwZgIG5bqTC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2652	2200	rundll32.exe	28
PID 2200 wrote to memory of 2652	2200	rundll32.exe	28
PID 2200 wrote to memory of 2652	2200	rundll32.exe	28
PID 2200 wrote to memory of 2652	2200	rundll32.exe	28
PID 2200 wrote to memory of 2652	2200	rundll32.exe	28
PID 2200 wrote to memory of 2652	2200	rundll32.exe	28
PID 2200 wrote to memory of 2652	2200	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ba365fe646db6779a4ffc9c16b3bde7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ba365fe646db6779a4ffc9c16b3bde7.dll,#1
  2⤵
  PID:2652