924a1579b3ef5e2973a6141d2d18ebfbd0b2dbabaaf2db18ec0d3f0087cbf2bc

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 06:41

Target

7659e39b9ecc9ce9f8ccfa878f3ffdd1.dll
Size

2.3MB
MD5

7659e39b9ecc9ce9f8ccfa878f3ffdd1
SHA1

c6a9cf4da61731051ba7c64a723218b28c21e3ce
SHA256

924a1579b3ef5e2973a6141d2d18ebfbd0b2dbabaaf2db18ec0d3f0087cbf2bc
SHA512

df611566114c6bea98c5673a96c052984a7eba08ca24c86bdfa548c81d503ad5c2470fd7ba2f3f5072f2060f89bf964a143e1f68dcd69ba36d37da557b9d2242
SSDEEP

49152:7L0JdWSVNJvYrIQGA1vPsP5ClxL5YrIQGA1vPsP5ClxLp:7L0JdXVPY0jAPsRClxL5Y0jAPsRClxLp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 2132	1144	rundll32.exe	20
PID 1144 wrote to memory of 2132	1144	rundll32.exe	20
PID 1144 wrote to memory of 2132	1144	rundll32.exe	20
PID 1144 wrote to memory of 2132	1144	rundll32.exe	20
PID 1144 wrote to memory of 2132	1144	rundll32.exe	20
PID 1144 wrote to memory of 2132	1144	rundll32.exe	20
PID 1144 wrote to memory of 2132	1144	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7659e39b9ecc9ce9f8ccfa878f3ffdd1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7659e39b9ecc9ce9f8ccfa878f3ffdd1.dll,#1
  2⤵
  PID:2132

memory/2132-1-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2132-0-0x0000000001D70000-0x0000000001FBE000-memory.dmp

Filesize
2.3MB

Download
memory/2132-2-0x0000000002510000-0x00000000025C5000-memory.dmp

Filesize
724KB

Download
memory/2132-3-0x0000000003060000-0x0000000003115000-memory.dmp

Filesize
724KB

Download
memory/2132-4-0x0000000001D70000-0x0000000001FBE000-memory.dmp

Filesize
2.3MB

Download
memory/2132-7-0x0000000003120000-0x00000000031D0000-memory.dmp

Filesize
704KB

Download
memory/2132-8-0x00000000031D0000-0x000000000326B000-memory.dmp

Filesize
620KB

Download
memory/2132-11-0x00000000031D0000-0x000000000326B000-memory.dmp

Filesize
620KB

Download
memory/2132-12-0x00000000031D0000-0x000000000326B000-memory.dmp

Filesize
620KB

Download
memory/2132-14-0x0000000003060000-0x0000000003115000-memory.dmp

Filesize
724KB

Download