b4facc08c669ba256e9750ea3e1639ebffbb2dbf74f2987fe508a34392480d14

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 22:30

Target

15d93682e466b60ea2df7b0bec372899.dll
Size

192KB
MD5

15d93682e466b60ea2df7b0bec372899
SHA1

94a1d096ecfff4036bbf3e99efc4fe64eaf8eecb
SHA256

b4facc08c669ba256e9750ea3e1639ebffbb2dbf74f2987fe508a34392480d14
SHA512

0517825cdbfbaad1b838ab5c60eaad9af22b03608d482a120a7b09cd08f152f750e447ce6eb94a4d9948d4d6b53cadfafb6abf0a40dee9d48bddf30ae92eb1ec
SSDEEP

3072:VNbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/HrmM:VNbqaLD7RcukVAtSQOWcgWqbV77LmM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2068	2064	rundll32.exe	28
PID 2064 wrote to memory of 2068	2064	rundll32.exe	28
PID 2064 wrote to memory of 2068	2064	rundll32.exe	28
PID 2064 wrote to memory of 2068	2064	rundll32.exe	28
PID 2064 wrote to memory of 2068	2064	rundll32.exe	28
PID 2064 wrote to memory of 2068	2064	rundll32.exe	28
PID 2064 wrote to memory of 2068	2064	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15d93682e466b60ea2df7b0bec372899.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15d93682e466b60ea2df7b0bec372899.dll,#1
  2⤵
  PID:2068