dcf93c6144fed5271fcce835bacc245aae1f00095bed6571620beef66f26d750

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:27

Target

15b230bb07aafefec90917215441c124.dll
Size

13KB
MD5

15b230bb07aafefec90917215441c124
SHA1

d7ebb0b834971c73f66131c80cfbfa959b609f61
SHA256

dcf93c6144fed5271fcce835bacc245aae1f00095bed6571620beef66f26d750
SHA512

13253a5cf42d78f9582a57da022947077c8329e666819063df5f8852c3194f46db22f7e8ac74ea5514440f203a54172673e426d5ef89163dad4d740a3a64d2d1
SSDEEP

192:4qZmrSrRYIRlm8SmhkMjyl2GlwgtNhXUcMEkSFacn2YE/eGNfWn0c:9mrORYMXkM82Gllji2nHSxe0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 2248	1060	rundll32.exe	28
PID 1060 wrote to memory of 2248	1060	rundll32.exe	28
PID 1060 wrote to memory of 2248	1060	rundll32.exe	28
PID 1060 wrote to memory of 2248	1060	rundll32.exe	28
PID 1060 wrote to memory of 2248	1060	rundll32.exe	28
PID 1060 wrote to memory of 2248	1060	rundll32.exe	28
PID 1060 wrote to memory of 2248	1060	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15b230bb07aafefec90917215441c124.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15b230bb07aafefec90917215441c124.dll,#1
  2⤵
  PID:2248

memory/2248-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2248-1-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2248-2-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2248-3-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2248-4-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download