0fad108e339a798a974809480f889f28d40f853ef3ee4e3d07943695adec4cbd

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 10:46

Target

0fad108e339a798a974809480f889f28d40f853ef3ee4e3d07943695adec4cbd.dll
Size

2.0MB
MD5

1d4ba8dd5787c37e6855cd8e951ae115
SHA1

961bb7abc0584521fc3a6b16e5815913775d648c
SHA256

0fad108e339a798a974809480f889f28d40f853ef3ee4e3d07943695adec4cbd
SHA512

858eac8407d9c50c632bc235391bb30da639c298a2a614260f35cde010e2644d8134113257ba6074f80f07982fdda3fa97a28886ea77b3050be29561ab56a4ef
SSDEEP

24576:cYG7K9TL9iSQCDv8ivLDgpYpk9MOS+MKMGAPG4tvRwLs57kcJrVhW4LfmiMg9fvG:cNe0JCDCpmqlSBcLsrJpNzmLg9fvwr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1340	1168	rundll32.exe	28
PID 1168 wrote to memory of 1340	1168	rundll32.exe	28
PID 1168 wrote to memory of 1340	1168	rundll32.exe	28
PID 1168 wrote to memory of 1340	1168	rundll32.exe	28
PID 1168 wrote to memory of 1340	1168	rundll32.exe	28
PID 1168 wrote to memory of 1340	1168	rundll32.exe	28
PID 1168 wrote to memory of 1340	1168	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fad108e339a798a974809480f889f28d40f853ef3ee4e3d07943695adec4cbd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fad108e339a798a974809480f889f28d40f853ef3ee4e3d07943695adec4cbd.dll,#1
  2⤵
  PID:1340