e225b24990c421974dbc356a5130d812a63620a442549e33b587a6b3cd4bb20e

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:41

Target

136720d89801ebf520f8199d79ccb128.dll
Size

264KB
MD5

136720d89801ebf520f8199d79ccb128
SHA1

e9454ed3763e5052e4eca98daaf68dd85280217b
SHA256

e225b24990c421974dbc356a5130d812a63620a442549e33b587a6b3cd4bb20e
SHA512

7cfd0131bb4f1b93edff4f4b16344c4c7837ef6be9f7739c50e9b07b43bb95890abc3cb7c0ab8cc647b9ecdf812817c45d837df984625d79ffece2c8cd563c7a
SSDEEP

3072:o0dzXkyttLU391eL7DSNh0fcnpdjgz8kboBfYjFzTbmUnAwB/yZHe0FSmGDN2nQN:o6kyrL5DSAfcnHc8QlFnbmU9RzhVn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2816	3044	rundll32.exe	14
PID 3044 wrote to memory of 2816	3044	rundll32.exe	14
PID 3044 wrote to memory of 2816	3044	rundll32.exe	14
PID 3044 wrote to memory of 2816	3044	rundll32.exe	14
PID 3044 wrote to memory of 2816	3044	rundll32.exe	14
PID 3044 wrote to memory of 2816	3044	rundll32.exe	14
PID 3044 wrote to memory of 2816	3044	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\136720d89801ebf520f8199d79ccb128.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\136720d89801ebf520f8199d79ccb128.dll,#1
  2⤵
  PID:2816